code: func NewServerTLSConfig(certs []tls.Certificate, rootCAPool *x509.CertPool) (*tls.Config, error) {
  	if rootCAPool == nil {
  		return nil, errors.New("valid root CA pool required")
  	}
  
  	return &tls.Config{
  		Certificates: certs,
  		// Since we're using the same CA server to issue Certificates to new nodes, we can't
  		// use tls.RequireAndVerifyClientCert
  		ClientAuth:               tls.VerifyClientCertIfGiven,
  		RootCAs:                  rootCAPool,
  		ClientCAs:                rootCAPool,
  		PreferServerCipherSuites: true,
  		MinVersion:               tls.VersionTLS12,
  	}, nil
  }
docs: // NewServerTLSConfig returns a tls.Config configured for a TLS Server, given a tls.Certificate
  // and the PEM-encoded root CA Certificate