code: func (t *TLSServer) GetConfigForClient(info *tls.ClientHelloInfo) (*tls.Config, error) {
  	var clusterName string
  	var err error
  	if info.ServerName != "" {
  		clusterName, err = auth.DecodeClusterName(info.ServerName)
  		if err != nil {
  			if !trace.IsNotFound(err) {
  				log.Debugf("Ignoring unsupported cluster name name %q.", info.ServerName)
  				clusterName = ""
  			}
  		}
  	}
  	pool, err := auth.ClientCertPool(t.AccessPoint, clusterName)
  	if err != nil {
  		log.Errorf("failed to retrieve client pool: %v", trace.DebugReport(err))
  		// this falls back to the default config
  		return nil, nil
  	}
  	tlsCopy := t.TLS.Clone()
  	tlsCopy.ClientCAs = pool
  	return tlsCopy, nil
  }
docs: // GetConfigForClient is getting called on every connection
  // and server's GetConfigForClient reloads the list of trusted
  // local and remote certificate authorities