code: func getCertificateSubject(tlsState *tls.ConnectionState) (pkix.Name, error) {
  	if tlsState == nil {
  		return pkix.Name{}, status.Errorf(codes.PermissionDenied, "request is not using TLS")
  	}
  	if len(tlsState.PeerCertificates) == 0 {
  		return pkix.Name{}, status.Errorf(codes.PermissionDenied, "no client certificates in request")
  	}
  	if len(tlsState.VerifiedChains) == 0 {
  		return pkix.Name{}, status.Errorf(codes.PermissionDenied, "no verified chains for remote certificate")
  	}
  
  	return tlsState.VerifiedChains[0][0].Subject, nil
  }
docs: // getCertificateSubject extracts the subject from a verified client certificate