code: func (a *Authenticator) AuthenticateRequest(req *http.Request) (*authenticator.Response, bool, error) {
  	if req.TLS == nil || len(req.TLS.PeerCertificates) == 0 {
  		return nil, false, nil
  	}
  
  	// Use intermediates, if provided
  	optsCopy := a.opts
  	if optsCopy.Intermediates == nil && len(req.TLS.PeerCertificates) > 1 {
  		optsCopy.Intermediates = x509.NewCertPool()
  		for _, intermediate := range req.TLS.PeerCertificates[1:] {
  			optsCopy.Intermediates.AddCert(intermediate)
  		}
  	}
  
  	remaining := req.TLS.PeerCertificates[0].NotAfter.Sub(time.Now())
  	clientCertificateExpirationHistogram.Observe(remaining.Seconds())
  	chains, err := req.TLS.PeerCertificates[0].Verify(optsCopy)
  	if err != nil {
  		return nil, false, err
  	}
  
  	var errlist []error
  	for _, chain := range chains {
  		user, ok, err := a.user.User(chain)
  		if err != nil {
  			errlist = append(errlist, err)
  			continue
  		}
  
  		if ok {
  			return user, ok, err
  		}
  	}
  	return nil, false, utilerrors.NewAggregate(errlist)
  }
docs: // AuthenticateRequest authenticates the request using presented client certificates