code: func (c *Configurator) commonTLSConfig(additionalVerifyIncomingFlag bool) *tls.Config {
  	c.RLock()
  	defer c.RUnlock()
  	tlsConfig := &tls.Config{
  		InsecureSkipVerify: !c.base.VerifyServerHostname,
  	}
  
  	// Set the cipher suites
  	if len(c.base.CipherSuites) != 0 {
  		tlsConfig.CipherSuites = c.base.CipherSuites
  	}
  
  	tlsConfig.PreferServerCipherSuites = c.base.PreferServerCipherSuites
  
  	tlsConfig.GetCertificate = func(*tls.ClientHelloInfo) (*tls.Certificate, error) {
  		return c.cert, nil
  	}
  	tlsConfig.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
  		return c.cert, nil
  	}
  
  	tlsConfig.ClientCAs = c.cas
  	tlsConfig.RootCAs = c.cas
  
  	// This is possible because TLSLookup also contains "" with golang's
  	// default (tls10). And because the initial check makes sure the
  	// version correctly matches.
  	tlsConfig.MinVersion = TLSLookup[c.base.TLSMinVersion]
  
  	// Set ClientAuth if necessary
  	if c.base.VerifyIncoming || additionalVerifyIncomingFlag {
  		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
  	}
  
  	return tlsConfig
  }
docs: // commonTLSConfig generates a *tls.Config from the base configuration the
  // Configurator has. It accepts an additional flag in case a config is needed
  // for incoming TLS connections.
  // This function acquires a read lock because it reads from the config.