code: func newAuthenticatorFromClientCAFile(clientCAFile string) (authenticator.Request, error) {
  	opts := x509request.DefaultVerifyOptions()
  
  	// If at custom CA bundle is provided, load it (otherwise just use system roots)
  	if len(clientCAFile) > 0 {
  		if caData, err := ioutil.ReadFile(clientCAFile); err != nil {
  			return nil, err
  		} else if len(caData) > 0 {
  			roots := x509.NewCertPool()
  			if !roots.AppendCertsFromPEM(caData) {
  				return nil, fmt.Errorf("no valid certs found in %s", clientCAFile)
  			}
  			opts.Roots = roots
  		}
  	}
  
  	return x509request.New(opts, x509request.CommonNameUserConversion), nil
  }
docs: // newAuthenticatorFromClientCAFile returns an authenticator.Request or an error