code: func NewTLSServer(cfg TLSServerConfig) (*TLSServer, error) {
  	if err := cfg.CheckAndSetDefaults(); err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// limiter limits requests by frequency and amount of simultaneous
  	// connections per client
  	limiter, err := limiter.NewLimiter(cfg.LimiterConfig)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	// authMiddleware authenticates request assuming TLS client authentication
  	// adds authentication information to the context
  	// and passes it to the API server
  	authMiddleware := &AuthMiddleware{
  		AccessPoint:   cfg.AccessPoint,
  		AcceptedUsage: cfg.AcceptedUsage,
  	}
  	authMiddleware.Wrap(NewGRPCServer(cfg.APIConfig))
  	// Wrap sets the next middleware in chain to the authMiddleware
  	limiter.WrapHandle(authMiddleware)
  	// force client auth if given
  	cfg.TLS.ClientAuth = tls.VerifyClientCertIfGiven
  	cfg.TLS.NextProtos = []string{http2.NextProtoTLS}
  
  	server := &TLSServer{
  		TLSServerConfig: cfg,
  		Server: &http.Server{
  			Handler: limiter,
  		},
  		Entry: logrus.WithFields(logrus.Fields{
  			trace.Component: cfg.Component,
  		}),
  	}
  	server.TLS.GetConfigForClient = server.GetConfigForClient
  	return server, nil
  }
docs: // NewTLSServer returns new unstarted TLS server