func adjustMinVersion(options Options, config *tls.Config) error {
	if options.MinVersion > 0 {
		if !isValidMinVersion(options.MinVersion) {
			return fmt.Errorf("Invalid minimum TLS version: %x", options.MinVersion)
		}
		if options.MinVersion < config.MinVersion {
			return fmt.Errorf("Requested minimum TLS version is too low. Should be at-least: %x", config.MinVersion)
		}
		config.MinVersion = options.MinVersion
	}
	return nil
}
adjustMinVersion sets the MinVersion on `config`, the input configuration.
It assumes the current MinVersion on the `config` is the lowest allowed.
package tlsconfig
import (
	"crypto/tls"
	"crypto/x509"
	"encoding/pem"
	"fmt"
	"io/ioutil"
	"os"
	"github.com/Sirupsen/logrus"
	"github.com/pkg/errors"
)
type Options struct {
	CAFile string
	CertFile string
	KeyFile  string
	InsecureSkipVerify bool
	ClientAuth tls.ClientAuthType
	ExclusiveRootPools bool
	MinVersion         uint16
	Passphrase string
}
var acceptedCBCCiphers = []uint16{
	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
	tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
	tls.TLS_RSA_WITH_AES_256_CBC_SHA,
	tls.TLS_RSA_WITH_AES_128_CBC_SHA,
}
var DefaultServerAcceptedCiphers = append(clientCipherSuites, acceptedCBCCiphers...)
var allTLSVersions = map[uint16]struct{}{
	tls.VersionSSL30: {},
	tls.VersionTLS10: {},
	tls.VersionTLS11: {},
	tls.VersionTLS12: {},
}
func ServerDefault() *tls.Config {
	return &tls.Config{
		MinVersion:               tls.VersionTLS10,
		PreferServerCipherSuites: true,
		CipherSuites:             DefaultServerAcceptedCiphers,
	}
}
func ClientDefault() *tls.Config {
	return &tls.Config{
		MinVersion:   tls.VersionTLS12,
		CipherSuites: clientCipherSuites,
	}
}
func certPool(caFile string, exclusivePool bool) (*x509.CertPool, error) {
	var (
		certPool *x509.CertPool
		err      error
	)
	if exclusivePool {
		certPool = x509.NewCertPool()
	} else {
		certPool, err = SystemCertPool()
		if err != nil {
			return nil, fmt.Errorf("failed to read system certificates: %v", err)
		}
	}
	pem, err := ioutil.ReadFile(caFile)
	if err != nil {
		return nil, fmt.Errorf("could not read CA certificate %q: %v", caFile, err)
	}
	if !certPool.AppendCertsFromPEM(pem) {
		return nil, fmt.Errorf("failed to append certificates from PEM file: %q", caFile)
	}
	logrus.Debugf("Trusting %d certs", len(certPool.Subjects()))
	return certPool, nil
}
func isValidMinVersion(version uint16) bool {
	_, ok := allTLSVersions[version]
	return ok
}