code: func NewTLSClient(cfg ClientConfig, params ...roundtrip.ClientParam) (*Client, error) {
  	if err := cfg.CheckAndSetDefaults(); err != nil {
  		return nil, trace.Wrap(err)
  	}
  	transport := &http.Transport{
  		// notice that below roundtrip.Client is passed
  		// teleport.APIEndpoint as an address for the API server, this is
  		// to make sure client verifies the DNS name of the API server
  		// custom DialContext overrides this DNS name to the real address
  		// in addition this dialer tries multiple adresses if provided
  		DialContext:           cfg.DialContext,
  		ResponseHeaderTimeout: defaults.DefaultDialTimeout,
  		TLSClientConfig:       cfg.TLS,
  
  		// Increase the size of the connection pool. This substantially improves the
  		// performance of Teleport under load as it reduces the number of TLS
  		// handshakes performed.
  		MaxIdleConns:        defaults.HTTPMaxIdleConns,
  		MaxIdleConnsPerHost: defaults.HTTPMaxIdleConnsPerHost,
  
  		// IdleConnTimeout defines the maximum amount of time before idle connections
  		// are closed. Leaving this unset will lead to connections open forever and
  		// will cause memory leaks in a long running process.
  		IdleConnTimeout: defaults.HTTPIdleTimeout,
  	}
  
  	clientParams := append(
  		[]roundtrip.ClientParam{
  			roundtrip.HTTPClient(&http.Client{Transport: transport}),
  			roundtrip.SanitizerEnabled(true),
  		},
  		params...,
  	)
  	roundtripClient, err := roundtrip.NewClient("https://"+teleport.APIDomain, CurrentVersion, clientParams...)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	return &Client{
  		ClientConfig: cfg,
  		Client:       *roundtripClient,
  		transport:    transport,
  	}, nil
  }
docs: // NewTLSClient returns a new TLS client that uses mutual TLS authentication
  // and dials the remote server using dialer