code: func (v *X509NameVerifier) Wrap(h http.Handler) http.Handler {
  	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
  		dn := r.Header.Get(v.HeaderName)
  
  		var name *pkix.Name
  		if dn != "" {
  			name = parseDN(dn)
  		}
  
  		if name != nil && v.CheckCertificate(name) {
  			h.ServeHTTP(w, r)
  		} else if v.InvalidHandler != nil {
  			v.InvalidHandler.ServeHTTP(w, r)
  		} else {
  			log.Printf("Rejected request with an invalid client certificate: %q", dn)
  			w.WriteHeader(403)
  		}
  	})
  }
docs: // Wrap wraps an HTTP handler to check the contents of client certificates.
  // If CheckCertificate returns true, the request will be passed to the wrapped
  // handler. If CheckCertificate returns false, it will be passed to the
  // InvalidHandler or, if no InvalidHandler is specified, will return an
  // empty 403 response and log the rejected DN.