code: func NewServer(c *cmd.GRPCServerConfig, tlsConfig *tls.Config, metrics serverMetrics, clk clock.Clock) (*grpc.Server, net.Listener, error) {
  	if tlsConfig == nil {
  		return nil, nil, errNilTLS
  	}
  	acceptedSANs := make(map[string]struct{})
  	for _, name := range c.ClientNames {
  		acceptedSANs[name] = struct{}{}
  	}
  
  	// Set the only acceptable TLS version to 1.2 and the only acceptable cipher suite
  	// to ECDHE-RSA-CHACHA20-POLY1305.
  	tlsConfig.MinVersion, tlsConfig.MaxVersion = tls.VersionTLS12, tls.VersionTLS12
  	tlsConfig.CipherSuites = []uint16{tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305}
  
  	creds, err := bcreds.NewServerCredentials(tlsConfig, acceptedSANs)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	l, err := net.Listen("tcp", c.Address)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	maxConcurrentStreams := c.MaxConcurrentStreams
  	if maxConcurrentStreams == 0 {
  		maxConcurrentStreams = 250
  	}
  	si := newServerInterceptor(metrics, clk)
  	return grpc.NewServer(
  		grpc.Creds(creds),
  		grpc.UnaryInterceptor(si.intercept),
  		grpc.MaxConcurrentStreams(uint32(maxConcurrentStreams)),
  	), l, nil
  }
docs: // NewServer creates a gRPC server that uses the provided *tls.Config, and
  // verifies that clients present a certificate that (a) is signed by one of
  // the configured ClientCAs, and (b) contains at least one
  // subjectAlternativeName matching the accepted list from GRPCServerConfig.