code: func cloneTLSClientConfig(cfg *tls.Config) *tls.Config {
  	if cfg == nil {
  		return &tls.Config{}
  	}
  	return &tls.Config{
  		Rand:                        cfg.Rand,
  		Time:                        cfg.Time,
  		Certificates:                cfg.Certificates,
  		NameToCertificate:           cfg.NameToCertificate,
  		GetCertificate:              cfg.GetCertificate,
  		RootCAs:                     cfg.RootCAs,
  		NextProtos:                  cfg.NextProtos,
  		ServerName:                  cfg.ServerName,
  		ClientAuth:                  cfg.ClientAuth,
  		ClientCAs:                   cfg.ClientCAs,
  		InsecureSkipVerify:          cfg.InsecureSkipVerify,
  		CipherSuites:                cfg.CipherSuites,
  		PreferServerCipherSuites:    cfg.PreferServerCipherSuites,
  		ClientSessionCache:          cfg.ClientSessionCache,
  		MinVersion:                  cfg.MinVersion,
  		MaxVersion:                  cfg.MaxVersion,
  		CurvePreferences:            cfg.CurvePreferences,
  		DynamicRecordSizingDisabled: cfg.DynamicRecordSizingDisabled,
  		Renegotiation:               cfg.Renegotiation,
  	}
  }
docs: // cloneTLSClientConfig is like cloneTLSConfig but omits
  // the fields SessionTicketsDisabled and SessionTicketKey.
  // This makes it safe to call cloneTLSClientConfig on a config
  // in active use by a server.