code: func (c *SessionContext) ClientTLSConfig(clusterName ...string) (*tls.Config, error) {
  	var certPool *x509.CertPool
  	if len(clusterName) == 0 {
  		certAuthorities, err := c.parent.proxyClient.GetCertAuthorities(services.HostCA, false)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		certPool, err = services.CertPoolFromCertAuthorities(certAuthorities)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	} else {
  		certAuthority, err := c.parent.proxyClient.GetCertAuthority(services.CertAuthID{
  			Type:       services.HostCA,
  			DomainName: clusterName[0],
  		}, false)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		certPool, err = services.CertPool(certAuthority)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  	}
  
  	tlsConfig := utils.TLSConfig(c.parent.cipherSuites)
  	tlsCert, err := tls.X509KeyPair(c.sess.GetTLSCert(), c.sess.GetPriv())
  	if err != nil {
  		return nil, trace.Wrap(err, "failed to parse TLS cert and key")
  	}
  	tlsConfig.Certificates = []tls.Certificate{tlsCert}
  	tlsConfig.RootCAs = certPool
  	tlsConfig.ServerName = auth.EncodeClusterName(c.parent.clusterName)
  	return tlsConfig, nil
  }
docs: // ClientTLSConfig returns client TLS authentication associated
  // with the web session context