func NewTLSClientConfig(rootCAs *x509.CertPool, certPath, certKeyPath string) (*tls.Config, error) {
	t := &tls.Config{
		MinVersion: tls.VersionTLS12,
		RootCAs:    rootCAs,
	}
	if certPath != "" {
		cp := config.GetActualValue(certPath)
		_, err := os.Stat(cp)
		if os.IsNotExist(err) {
			return nil, errors.New("client certificate not found")
		}
		ckp := config.GetActualValue(certKeyPath)
		_, err = os.Stat(ckp)
		if os.IsNotExist(err) {
			return nil, errors.New("client certificate key not found")
		}
		cert, err := tls.LoadX509KeyPair(cp, ckp)
		if err != nil {
			return nil, err
		}
		t.Certificates = []tls.Certificate{cert}
	}
	return t, nil
}
NewTLSClientConfig returns a client *tls.Config struct or error.
package service
import (
	"crypto/tls"
	"crypto/x509"
	"io/ioutil"
	"os"
	"github.com/pkg/errors"
	"github.com/yahoojapan/athenz-client-sidecar/v2/config"
)
var (
	ErrTLSCertOrKeyNotFound = errors.New("Cert/Key path not found")
)
func NewTLSConfig(cfg config.TLS) (*tls.Config, error) {
	t := &tls.Config{
		MinVersion: tls.VersionTLS12,
		CurvePreferences: []tls.CurveID{
			tls.CurveP521,
			tls.CurveP384,
			tls.CurveP256,
			tls.X25519,
		},
		SessionTicketsDisabled: true,
		ClientAuth:             tls.NoClientCert,
	}
	cert := config.GetActualValue(cfg.CertPath)
	key := config.GetActualValue(cfg.KeyPath)
	ca := config.GetActualValue(cfg.CAPath)
	if cert == "" || key == "" {
		return nil, ErrTLSCertOrKeyNotFound
	}
	crt, err := tls.LoadX509KeyPair(cert, key)
	if err != nil {
		return nil, err
	}
	t.Certificates = make([]tls.Certificate, 1)
	t.Certificates[0] = crt
	if ca != "" {
		pool, err := NewX509CertPool(ca)
		if err != nil {
			return nil, err
		}
		t.ClientCAs = pool
		t.ClientAuth = tls.RequireAndVerifyClientCert
	}
	return t, nil
}
func NewX509CertPool(path string) (*x509.CertPool, error) {
	var pool *x509.CertPool
	c, err := ioutil.ReadFile(path)
	if err == nil && c != nil {
		pool, err = x509.SystemCertPool()
		if err != nil || pool == nil {
			pool = x509.NewCertPool()
		}
		if !pool.AppendCertsFromPEM(c) {
			err = errors.New("Certification Failed")
		}
	}
	return pool, err
}