code: func (sm *Manager) LoginExtensionByCertificate(ctx context.Context, key string) error {
  	c := sm.client
  	u := c.URL()
  	if u.Hostname() != "sdkTunnel" {
  		sc := c.Tunnel()
  		c = &vim25.Client{
  			Client:         sc,
  			RoundTripper:   sc,
  			ServiceContent: c.ServiceContent,
  		}
  		// When http.Transport.Proxy is used, our thumbprint checker is bypassed, resulting in:
  		// "Post https://sdkTunnel:8089/sdk: x509: certificate is valid for $vcenter_hostname, not sdkTunnel"
  		// The only easy way around this is to disable verification for the call to LoginExtensionByCertificate().
  		// TODO: find a way to avoid disabling InsecureSkipVerify.
  		c.Transport.(*http.Transport).TLSClientConfig.InsecureSkipVerify = true
  	}
  
  	req := types.LoginExtensionByCertificate{
  		This:         sm.Reference(),
  		ExtensionKey: key,
  		Locale:       Locale,
  	}
  
  	login, err := methods.LoginExtensionByCertificate(ctx, c, &req)
  	if err != nil {
  		return err
  	}
  
  	// Copy the session cookie
  	sm.client.Jar.SetCookies(u, c.Jar.Cookies(c.URL()))
  
  	sm.userSession = &login.Returnval
  	return nil
  }
docs: // LoginExtensionByCertificate uses the vCenter SDK tunnel to login using a client certificate.
  // The client certificate can be set using the soap.Client.SetCertificate method.
  // See: https://kb.vmware.com/s/article/2004305