authentication/certs.go
func (v *X509NameVerifier) Wrap(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		dn := r.Header.Get(v.HeaderName)

		var name *pkix.Name
		if dn != "" {
			name = parseDN(dn)
		}

		if name != nil && v.CheckCertificate(name) {
			h.ServeHTTP(w, r)
		} else if v.InvalidHandler != nil {
			v.InvalidHandler.ServeHTTP(w, r)
		} else {
			log.Printf("Rejected request with an invalid client certificate: %q", dn)
			w.WriteHeader(403)
		}
	})
}
func (v *X509NameVerifier) Wrap(h http.Handler) http.Handler {
	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		dn := r.Header.Get(v.HeaderName)

		var name *pkix.Name
		if dn != "" {
			name = parseDN(dn)
		}

		if name != nil && v.CheckCertificate(name) {
			h.ServeHTTP(w, r)
		} else if v.InvalidHandler != nil {
			v.InvalidHandler.ServeHTTP(w, r)
		} else {
			log.Printf("Rejected request with an invalid client certificate: %q", dn)
			w.WriteHeader(403)
		}
	})
}
// Wrap wraps an HTTP handler to check the contents of client certificates.
// If CheckCertificate returns true, the request will be passed to the wrapped
// handler. If CheckCertificate returns false, it will be passed to the
// InvalidHandler or, if no InvalidHandler is specified, will return an
// empty 403 response and log the rejected DN.