code: func getClientCertForHost(c *Client, host string) *tls.Certificate {
  	hostSslKey, _ := c.uc.Get("http", fmt.Sprintf("https://%v/", host), "sslKey")
  	hostSslCert, _ := c.uc.Get("http", fmt.Sprintf("https://%v/", host), "sslCert")
  
  	cert, err := ioutil.ReadFile(hostSslCert)
  	if err != nil {
  		tracerx.Printf("Error reading client cert file %q: %v", hostSslCert, err)
  		return nil
  	}
  	key, err := ioutil.ReadFile(hostSslKey)
  	if err != nil {
  		tracerx.Printf("Error reading client key file %q: %v", hostSslKey, err)
  		return nil
  	}
  
  	block, _ := pem.Decode(key)
  	if x509.IsEncryptedPEMBlock(block) {
  		key, err = decryptPEMBlock(c, block, hostSslKey, key)
  		if err != nil {
  			tracerx.Printf("Unable to decrypt client key file %q: %v", hostSslKey, err)
  			return nil
  		}
  	}
  
  	certobj, err := tls.X509KeyPair(cert, key)
  	if err != nil {
  		tracerx.Printf("Error reading client cert/key %v", err)
  		return nil
  	}
  	return &certobj
  }
docs: // getClientCertForHost returns a client certificate for a specific host (which may
  // be "host:port" loaded from the gitconfig