// VerifyPeerCertificate returns an error if the peer should not be
    // trusted. It will be called after the initial handshake and before
    // any other verification checks on the cert or chain are performed.
    // This provides the callee an opportunity to augment the certificate
    // verification.
    //
    // If VerifyPeerCertificate is not nil and returns an error,
    // then the handshake will fail.
    VerifyPeerCertificate func(peer []*x509.Certificate) error

    c := &http.Client{
        Transport: &http.Transport{
            Proxy: http.ProxyFromEnvironment,
            Dial: (&net.Dialer{
                Timeout:   60 * time.Second,
                KeepAlive: 60 * time.Second,
            }).Dial,
            TLSHandshakeTimeout:   10 * time.Second,
            ExpectContinueTimeout: 1 * time.Second,
            TLSClientConfig: &tls.Config{
                // inject our callback to check the peer here
                NextProtos:            []string{"h2"},
                VerifyPeerCertificate: verifyPeerCertificate,
            },
            TLSNextProto: map[string]func(authority string, c *tls.Conn) http.RoundTripper{
                "h2": func(authority string, c *tls.Conn) http.RoundTripper {
                    return http.DefaultTransport
                },
            },
        },
    }