code: func (s *Security) ToTLSConfig() (*tls.Config, error) {
  	var tlsConfig *tls.Config
  	if len(s.ClusterSSLCA) != 0 {
  		var certificates = make([]tls.Certificate, 0)
  		if len(s.ClusterSSLCert) != 0 && len(s.ClusterSSLKey) != 0 {
  			// Load the client certificates from disk
  			certificate, err := tls.LoadX509KeyPair(s.ClusterSSLCert, s.ClusterSSLKey)
  			if err != nil {
  				return nil, errors.Errorf("could not load client key pair: %s", err)
  			}
  			certificates = append(certificates, certificate)
  		}
  
  		// Create a certificate pool from the certificate authority
  		certPool := x509.NewCertPool()
  		ca, err := ioutil.ReadFile(s.ClusterSSLCA)
  		if err != nil {
  			return nil, errors.Errorf("could not read ca certificate: %s", err)
  		}
  
  		// Append the certificates from the CA
  		if !certPool.AppendCertsFromPEM(ca) {
  			return nil, errors.New("failed to append ca certs")
  		}
  
  		tlsConfig = &tls.Config{
  			Certificates: certificates,
  			RootCAs:      certPool,
  		}
  	}
  
  	return tlsConfig, nil
  }
docs: // ToTLSConfig generates tls's config based on security section of the config.