code: func (c *EndpointConfig) loadTLSClientCerts(configEntity *endpointConfigEntity) error {
  
  	var clientCerts tls.Certificate
  	cb := configEntity.Client.TLSCerts.Client.Cert.Bytes()
  	if len(cb) == 0 {
  		// if no cert found in the config, empty cert chain should be used
  		c.tlsClientCerts = []tls.Certificate{clientCerts}
  		return nil
  	}
  
  	// Load private key from cert using default crypto suite
  	cs := cryptosuite.GetDefault()
  	pk, err := cryptoutil.GetPrivateKeyFromCert(cb, cs)
  
  	// If CryptoSuite fails to load private key from cert then load private key from config
  	if err != nil || pk == nil {
  		logger.Debugf("Reading pk from config, unable to retrieve from cert: %s", err)
  		tlsClientCerts, error := c.loadPrivateKeyFromConfig(&configEntity.Client, clientCerts, cb)
  		if error != nil {
  			return errors.WithMessage(error, "failed to load TLS client certs")
  		}
  		c.tlsClientCerts = tlsClientCerts
  		return nil
  	}
  
  	// private key was retrieved from cert
  	clientCerts, err = cryptoutil.X509KeyPair(cb, pk, cs)
  	if err != nil {
  		return errors.WithMessage(err, "failed to load TLS client certs, failed to get X509KeyPair")
  	}
  
  	c.tlsClientCerts = []tls.Certificate{clientCerts}
  	return nil
  }
docs: // loadTLSClientCerts loads the client's certs for mutual TLS
  // It checks the config for embedded pem files before looking for cert files