code: func newTLSConfig(certPath, keyPath, caPath, serverName string, insecure bool) (*tls.Config, error) {
  	if certPath != "" && keyPath == "" || certPath == "" && keyPath != "" {
  		return nil, errors.New("either both cert and key or none must be provided")
  	}
  	var certificates []tls.Certificate
  	if certPath != "" {
  		cert, err := tls.LoadX509KeyPair(certPath, keyPath)
  		if err != nil {
  			return nil, fmt.Errorf("could not load TLS cert: %s", err)
  		}
  		certificates = append(certificates, cert)
  	}
  	roots, err := loadRoots(caPath)
  	if err != nil {
  		return nil, err
  	}
  
  	return &tls.Config{
  		Certificates:       certificates,
  		RootCAs:            roots,
  		InsecureSkipVerify: insecure,
  		ServerName:         serverName,
  	}, nil
  }
docs: // loads TLS artifacts and builds tls.Clonfig object