code: func NewExternalCATLSConfig(certs []tls.Certificate, rootPool *x509.CertPool) *tls.Config {
  	return &tls.Config{
  		Certificates: certs,
  		RootCAs:      rootPool,
  		MinVersion:   tls.VersionTLS12,
  	}
  }
docs: // NewExternalCATLSConfig takes a TLS certificate and root pool and returns a TLS config that can be updated
  // without killing existing connections