code: func (a *Verifier) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
  	if req.TLS == nil || len(req.TLS.PeerCertificates) == 0 {
  		return nil, false, nil
  	}
  
  	// Use intermediates, if provided
  	optsCopy := a.opts
  	if optsCopy.Intermediates == nil && len(req.TLS.PeerCertificates) > 1 {
  		optsCopy.Intermediates = x509.NewCertPool()
  		for _, intermediate := range req.TLS.PeerCertificates[1:] {
  			optsCopy.Intermediates.AddCert(intermediate)
  		}
  	}
  
  	if _, err := req.TLS.PeerCertificates[0].Verify(optsCopy); err != nil {
  		return nil, false, err
  	}
  	if err := a.verifySubject(req.TLS.PeerCertificates[0].Subject); err != nil {
  		return nil, false, err
  	}
  	return a.auth.AuthenticateRequest(req)
  }
docs: // AuthenticateRequest verifies the presented client certificate, then delegates to the wrapped auth