code: func (tc *serverTransportCredentials) ServerHandshake(rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
  	// Perform the server <- client TLS handshake. This will validate the peer's
  	// client certificate.
  	conn := tls.Server(rawConn, tc.serverConfig)
  	if err := conn.Handshake(); err != nil {
  		return nil, nil, err
  	}
  
  	// In addition to the validation from `conn.Handshake()` we apply further
  	// constraints on what constitutes a valid peer
  	if err := tc.validateClient(conn.ConnectionState()); err != nil {
  		return nil, nil, err
  	}
  
  	return conn, credentials.TLSInfo{State: conn.ConnectionState()}, nil
  }
docs: // ServerHandshake does the authentication handshake for servers. It returns
  // the authenticated connection and the corresponding auth information about
  // the connection.