code: func (t *TLSConfig) Load() (*tls.Config, error) {
  	if t == nil {
  		return nil, fmt.Errorf("nil TLS section in config")
  	}
  	if t.CertFile == nil {
  		return nil, fmt.Errorf("nil CertFile in TLSConfig")
  	}
  	if t.KeyFile == nil {
  		return nil, fmt.Errorf("nil KeyFile in TLSConfig")
  	}
  	if t.CACertFile == nil {
  		return nil, fmt.Errorf("nil CACertFile in TLSConfig")
  	}
  	caCertBytes, err := ioutil.ReadFile(*t.CACertFile)
  	if err != nil {
  		return nil, fmt.Errorf("reading CA cert from %q: %s", *t.CACertFile, err)
  	}
  	rootCAs := x509.NewCertPool()
  	if ok := rootCAs.AppendCertsFromPEM(caCertBytes); !ok {
  		return nil, fmt.Errorf("parsing CA certs from %s failed", *t.CACertFile)
  	}
  	cert, err := tls.LoadX509KeyPair(*t.CertFile, *t.KeyFile)
  	if err != nil {
  		return nil, fmt.Errorf("loading key pair from %q and %q: %s",
  			*t.CertFile, *t.KeyFile, err)
  	}
  	return &tls.Config{
  		RootCAs:      rootCAs,
  		ClientCAs:    rootCAs,
  		ClientAuth:   tls.RequireAndVerifyClientCert,
  		Certificates: []tls.Certificate{cert},
  	}, nil
  }
docs: // Load reads and parses the certificates and key listed in the TLSConfig, and
  // returns a *tls.Config suitable for either client or server use.