code: func (t *TestTLSServer) ClientTLSConfig(identity TestIdentity) (*tls.Config, error) {
  	tlsConfig, err := t.Identity.TLSConfig(t.AuthServer.CipherSuites)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	if identity.I != nil {
  		cert, err := t.AuthServer.NewCertificate(identity)
  		if err != nil {
  			return nil, trace.Wrap(err)
  		}
  		tlsConfig.Certificates = []tls.Certificate{*cert}
  	} else {
  		// this client is not authenticated, which means that auth
  		// server should apply Nop builtin role
  		tlsConfig.Certificates = nil
  	}
  	return tlsConfig, nil
  }
docs: // ClientTLSConfig returns client TLS config based on the identity