code: func (c *MutableTLSCreds) ClientHandshake(ctx context.Context, addr string, rawConn net.Conn) (net.Conn, credentials.AuthInfo, error) {
  	// borrow all the code from the original TLS credentials
  	c.Lock()
  	if c.config.ServerName == "" {
  		colonPos := strings.LastIndex(addr, ":")
  		if colonPos == -1 {
  			colonPos = len(addr)
  		}
  		c.config.ServerName = addr[:colonPos]
  	}
  
  	conn := tls.Client(rawConn, c.config)
  	// Need to allow conn.Handshake to have access to config,
  	// would create a deadlock otherwise
  	c.Unlock()
  	var err error
  	errChannel := make(chan error, 1)
  	go func() {
  		errChannel <- conn.Handshake()
  	}()
  	select {
  	case err = <-errChannel:
  	case <-ctx.Done():
  		err = ctx.Err()
  	}
  	if err != nil {
  		rawConn.Close()
  		return nil, nil, err
  	}
  	return conn, nil, nil
  }
docs: // ClientHandshake implements the credentials.TransportCredentials interface