code: func newServerSideVerifier(client *api.Client, serviceName string) verifierFunc {
  	return func(tlsCfg *tls.Config, rawCerts [][]byte) error {
  		leaf, err := verifyChain(tlsCfg, rawCerts, false)
  		if err != nil {
  			log.Printf("connect: failed TLS verification: %s", err)
  			return err
  		}
  
  		// Check leaf is a cert we understand
  		if len(leaf.URIs) < 1 {
  			log.Printf("connect: invalid leaf certificate")
  			return errors.New("connect: invalid leaf certificate")
  		}
  
  		certURI, err := connect.ParseCertURI(leaf.URIs[0])
  		if err != nil {
  			log.Printf("connect: invalid leaf certificate URI")
  			return errors.New("connect: invalid leaf certificate URI")
  		}
  
  		// No AuthZ if there is no client.
  		if client == nil {
  			log.Printf("connect: nil client")
  			return nil
  		}
  
  		// Perform AuthZ
  		req := &api.AgentAuthorizeParams{
  			Target:           serviceName,
  			ClientCertURI:    certURI.URI().String(),
  			ClientCertSerial: connect.HexString(leaf.SerialNumber.Bytes()),
  		}
  		resp, err := client.Agent().ConnectAuthorize(req)
  		if err != nil {
  			log.Printf("connect: authz call failed: %s", err)
  			return errors.New("connect: authz call failed: " + err.Error())
  		}
  		if !resp.Authorized {
  			log.Printf("connect: authz call denied: %s", resp.Reason)
  			return errors.New("connect: authz denied: " + resp.Reason)
  		}
  		return nil
  	}
  }
docs: // newServerSideVerifier returns a verifierFunc that wraps the provided
  // api.Client to verify the TLS chain and perform AuthZ for the server end of
  // the connection. The service name provided is used as the target service name
  // for the Authorization.