code: func (t *TLSServer) GetConfigForClient(info *tls.ClientHelloInfo) (*tls.Config, error) {
  	var clusterName string
  	var err error
  	if info.ServerName != "" {
  		clusterName, err = DecodeClusterName(info.ServerName)
  		if err != nil {
  			if !trace.IsNotFound(err) {
  				t.Warningf("Client sent unsupported cluster name %q, what resulted in error %v.", info.ServerName, err)
  				return nil, trace.AccessDenied("access is denied")
  			}
  		}
  	}
  
  	// update client certificate pool based on currently trusted TLS
  	// certificate authorities.
  	// TODO(klizhentas) drop connections of the TLS cert authorities
  	// that are not trusted
  	pool, err := ClientCertPool(t.AccessPoint, clusterName)
  	if err != nil {
  		var ourClusterName string
  		if clusterName, err := t.AccessPoint.GetClusterName(); err == nil {
  			ourClusterName = clusterName.GetClusterName()
  		}
  		t.Errorf("Failed to retrieve client pool. Client cluster %v, target cluster %v, error:  %v.", clusterName, ourClusterName, trace.DebugReport(err))
  		// this falls back to the default config
  		return nil, nil
  	}
  	tlsCopy := t.TLS.Clone()
  	tlsCopy.ClientCAs = pool
  	for _, cert := range tlsCopy.Certificates {
  		t.Debugf("Server certificate %v.", TLSCertInfo(&cert))
  	}
  	return tlsCopy, nil
  }
docs: // GetConfigForClient is getting called on every connection
  // and server's GetConfigForClient reloads the list of trusted
  // local and remote certificate authorities