code: func (s *Server) StartTunnel() error {
  	tunnel := &http.Server{
  		Addr:    fmt.Sprintf("%s:%d", s.URL.Hostname(), s.Tunnel),
  		Handler: http.HandlerFunc(s.proxy),
  	}
  
  	l, err := net.Listen("tcp", tunnel.Addr)
  	if err != nil {
  		return err
  	}
  
  	if s.Tunnel == 0 {
  		s.Tunnel = l.Addr().(*net.TCPAddr).Port
  	}
  
  	// Set client proxy port (defaults to vCenter host port 80 in real life)
  	q := s.URL.Query()
  	q.Set("GOVMOMI_TUNNEL_PROXY_PORT", strconv.Itoa(s.Tunnel))
  	s.URL.RawQuery = q.Encode()
  
  	go tunnel.Serve(l)
  
  	return nil
  }
docs: // StartTunnel runs an HTTP proxy for tunneling SDK requests that require TLS client certificate authentication.