code: func X509KeyPair(certPEMBlock []byte, pk core.Key, cs core.CryptoSuite) (tls.Certificate, error) {
  
  	fail := func(err error) (tls.Certificate, error) { return tls.Certificate{}, err }
  
  	var cert tls.Certificate
  	for {
  		var certDERBlock *pem.Block
  		certDERBlock, certPEMBlock = pem.Decode(certPEMBlock)
  		if certDERBlock == nil {
  			break
  		}
  		if certDERBlock.Type == "CERTIFICATE" {
  			cert.Certificate = append(cert.Certificate, certDERBlock.Bytes)
  		} else {
  			logger.Debugf("Skipping block type: %s", certDERBlock.Type)
  		}
  	}
  
  	if len(cert.Certificate) == 0 {
  		return fail(errors.New("No certs available from bytes"))
  	}
  
  	// We are parsing public key for TLS to find its type
  	x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
  	if err != nil {
  		return fail(err)
  	}
  
  	switch x509Cert.PublicKey.(type) {
  	case *rsa.PublicKey:
  		cert.PrivateKey = &PrivateKey{cs, pk, &rsa.PublicKey{}}
  	case *ecdsa.PublicKey:
  		cert.PrivateKey = &PrivateKey{cs, pk, &ecdsa.PublicKey{}}
  	default:
  		return fail(errors.New("tls: unknown public key algorithm"))
  	}
  
  	return cert, nil
  }
docs: // X509KeyPair will return cer/key pair used for mutual TLS