code: func buildTLSConfig(tlsOption TLS) (*tls.Config, error) {
  	conf := &tls.Config{}
  
  	// ensure http2 enabled
  	conf.NextProtos = []string{"h2", "http/1.1", tlsalpn01.ACMETLS1Protocol}
  
  	if len(tlsOption.ClientCA.Files) > 0 {
  		pool := x509.NewCertPool()
  		for _, caFile := range tlsOption.ClientCA.Files {
  			data, err := caFile.Read()
  			if err != nil {
  				return nil, err
  			}
  			ok := pool.AppendCertsFromPEM(data)
  			if !ok {
  				return nil, fmt.Errorf("invalid certificate(s) in %s", caFile)
  			}
  		}
  		conf.ClientCAs = pool
  		if tlsOption.ClientCA.Optional {
  			conf.ClientAuth = tls.VerifyClientCertIfGiven
  		} else {
  			conf.ClientAuth = tls.RequireAndVerifyClientCert
  		}
  	}
  
  	// Set the minimum TLS version if set in the config TOML
  	if minConst, exists := MinVersion[tlsOption.MinVersion]; exists {
  		conf.PreferServerCipherSuites = true
  		conf.MinVersion = minConst
  	}
  
  	// Set the list of CipherSuites if set in the config TOML
  	if tlsOption.CipherSuites != nil {
  		// if our list of CipherSuites is defined in the entryPoint config, we can re-initialize the suites list as empty
  		conf.CipherSuites = make([]uint16, 0)
  		for _, cipher := range tlsOption.CipherSuites {
  			if cipherConst, exists := CipherSuites[cipher]; exists {
  				conf.CipherSuites = append(conf.CipherSuites, cipherConst)
  			} else {
  				// CipherSuite listed in the toml does not exist in our listed
  				return nil, fmt.Errorf("invalid CipherSuite: %s", cipher)
  			}
  		}
  	}
  
  	return conf, nil
  }
docs: // creates a TLS config that allows terminating HTTPS for multiple domains using SNI