code: func (cc *certConfigCache) GetConfigForClient(hello *tls.ClientHelloInfo) (*tls.Config, error) {
  	if cc.config != nil && time.Now().Before(cc.expires) {
  		return cc.config, nil
  	}
  	config := new(tls.Config)
  	cert, err := tls.LoadX509KeyPair(cc.tlsCert, cc.tlsKey)
  	if err != nil {
  		return nil, err
  	}
  	config.Certificates = []tls.Certificate{cert}
  	if len(cc.tlsCA) > 0 {
  		caBytes, err := ioutil.ReadFile(cc.tlsCA)
  		if err != nil {
  			return nil, err
  		}
  		certPool := x509.NewCertPool()
  		certPool.AppendCertsFromPEM(caBytes)
  		config.ClientCAs = certPool
  		config.ClientAuth = tls.RequireAndVerifyClientCert
  	}
  	cc.config = config
  	cc.expires = time.Now().Add(certRefreshInterval)
  	return config, nil
  }
docs: // GetConfigForClient gets the tlsConfig for the streaming server.
  // This allows the certs to be swapped, without shutting down crio.