code: func (flag *ClientFlag) configure(sc *soap.Client) (soap.RoundTripper, error) {
  	if flag.cert != "" {
  		cert, err := tls.LoadX509KeyPair(flag.cert, flag.key)
  		if err != nil {
  			return nil, err
  		}
  
  		sc.SetCertificate(cert)
  	}
  
  	// Set namespace and version
  	sc.Namespace = "urn:" + flag.vimNamespace
  	sc.Version = flag.vimVersion
  
  	sc.UserAgent = fmt.Sprintf("govc/%s", Version)
  
  	if err := flag.SetRootCAs(sc); err != nil {
  		return nil, err
  	}
  
  	if err := sc.LoadThumbprints(flag.tlsKnownHosts); err != nil {
  		return nil, err
  	}
  
  	if t, ok := sc.Transport.(*http.Transport); ok {
  		var err error
  
  		value := os.Getenv("GOVC_TLS_HANDSHAKE_TIMEOUT")
  		if value != "" {
  			t.TLSHandshakeTimeout, err = time.ParseDuration(value)
  			if err != nil {
  				return nil, err
  			}
  		}
  	}
  
  	// Retry twice when a temporary I/O error occurs.
  	// This means a maximum of 3 attempts.
  	return vim25.Retry(sc, vim25.TemporaryNetworkError(3)), nil
  }
docs: // configure TLS and retry settings before making any connections