code: func ReadTLSIdentityFromKeyPair(keyBytes, certBytes []byte, caCertsBytes [][]byte) (*Identity, error) {
  	if len(keyBytes) == 0 {
  		return nil, trace.BadParameter("missing private key")
  	}
  
  	if len(certBytes) == 0 {
  		return nil, trace.BadParameter("missing certificate")
  	}
  
  	cert, err := tlsca.ParseCertificatePEM(certBytes)
  	if err != nil {
  		return nil, trace.Wrap(err, "failed to parse TLS certificate")
  	}
  
  	id, err := tlsca.FromSubject(cert.Subject)
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  
  	if len(cert.Issuer.Organization) == 0 {
  		return nil, trace.BadParameter("missing CA organization")
  	}
  
  	clusterName := cert.Issuer.Organization[0]
  	if clusterName == "" {
  		return nil, trace.BadParameter("misssing cluster name")
  	}
  	identity := &Identity{
  		ID:              IdentityID{HostUUID: id.Username, Role: teleport.Role(id.Groups[0])},
  		ClusterName:     clusterName,
  		KeyBytes:        keyBytes,
  		TLSCertBytes:    certBytes,
  		TLSCACertsBytes: caCertsBytes,
  		XCert:           cert,
  	}
  	// The passed in ciphersuites don't appear to matter here since the returned
  	// *tls.Config is never actually used?
  	_, err = identity.TLSConfig(utils.DefaultCipherSuites())
  	if err != nil {
  		return nil, trace.Wrap(err)
  	}
  	return identity, nil
  }
docs: // ReadTLSIdentityFromKeyPair reads TLS identity from key pair