code: func LoadSecurityConfig(ctx context.Context, rootCA RootCA, krw *KeyReadWriter, allowExpired bool) (*SecurityConfig, func() error, error) {
  	ctx = log.WithModule(ctx, "tls")
  
  	// At this point we've successfully loaded the CA details from disk, or
  	// successfully downloaded them remotely. The next step is to try to
  	// load our certificates.
  
  	// Read both the Cert and Key from disk
  	cert, key, err := krw.Read()
  	if err != nil {
  		return nil, nil, err
  	}
  
  	// Check to see if this certificate was signed by our CA, and isn't expired
  	_, chains, err := ValidateCertChain(rootCA.Pool, cert, allowExpired)
  	if err != nil {
  		return nil, nil, err
  	}
  	// ValidateChain, if successful, will always return at least 1 chain containing
  	// at least 2 certificates:  the leaf and the root.
  	issuer := chains[0][1]
  
  	// Now that we know this certificate is valid, create a TLS Certificate for our
  	// credentials
  	keyPair, err := tls.X509KeyPair(cert, key)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	secConfig, cleanup, err := NewSecurityConfig(&rootCA, krw, &keyPair, &IssuerInfo{
  		Subject:   issuer.RawSubject,
  		PublicKey: issuer.RawSubjectPublicKeyInfo,
  	})
  	if err == nil {
  		log.G(ctx).WithFields(logrus.Fields{
  			"node.id":   secConfig.ClientTLSCreds.NodeID(),
  			"node.role": secConfig.ClientTLSCreds.Role(),
  		}).Debug("loaded node credentials")
  	}
  	return secConfig, cleanup, err
  }
docs: // LoadSecurityConfig loads TLS credentials from disk, or returns an error if
  // these credentials do not exist or are unusable.