code: func newAuthenticatorFromClientCAFile(clientCAFile string) (authenticator.Request, error) {
  	roots, err := certutil.NewPool(clientCAFile)
  	if err != nil {
  		return nil, err
  	}
  
  	opts := x509.DefaultVerifyOptions()
  	opts.Roots = roots
  
  	return x509.New(opts, x509.CommonNameUserConversion), nil
  }
docs: // newAuthenticatorFromClientCAFile returns an authenticator.Request or an error