code: func NewCredentialsClient(proxyAddr string, insecure bool, pool *x509.CertPool) (*CredentialsClient, error) {
  	log := logrus.WithFields(logrus.Fields{
  		trace.Component: teleport.ComponentClient,
  	})
  	log.Debugf("HTTPS client init(proxyAddr=%v, insecure=%v)", proxyAddr, insecure)
  
  	// validate proxyAddr:
  	host, port, err := net.SplitHostPort(proxyAddr)
  	if err != nil || host == "" || port == "" {
  		if err != nil {
  			log.Error(err)
  		}
  		return nil, trace.BadParameter("'%v' is not a valid proxy address", proxyAddr)
  	}
  	proxyAddr = "https://" + net.JoinHostPort(host, port)
  	u, err := url.Parse(proxyAddr)
  	if err != nil {
  		return nil, trace.BadParameter("'%v' is not a valid proxy address", proxyAddr)
  	}
  
  	var opts []roundtrip.ClientParam
  
  	if insecure {
  		// Skip https cert verification, print a warning that this is insecure.
  		fmt.Printf("WARNING: You are using insecure connection to SSH proxy %v\n", proxyAddr)
  		opts = append(opts, roundtrip.HTTPClient(NewInsecureWebClient()))
  	} else if pool != nil {
  		// use custom set of trusted CAs
  		opts = append(opts, roundtrip.HTTPClient(newClientWithPool(pool)))
  	}
  
  	clt, err := NewWebClient(proxyAddr, opts...)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	return &CredentialsClient{
  		log: log,
  		clt: clt,
  		url: u,
  	}, nil
  }
docs: // NewCredentialsClient creates a new client to the HTTPS web proxy.