// ServerHelloInfo contains information from a ServerHello message in order to
// guide certificate selection in the GetClientCertificate callback.
type ServerHelloInfo struct {
    // CertCAs lists the CA root certificates accepted for successful
    // client authentication.
    CertCAs [][]byte

    // CertTypes lists the supported certificate types for each CA cert.
    CertTypes []byte
}
:
type Config struct {
    :
    // GetClientCertificate returns a Certificate based on the given
    // ServerHelloInfo. It will only be called if the server requests
    // client authentication and if Certificates is empty.
    //
    // If GetClientCertificate is nil or returns nil, no client certificate
    // is send to the server as a response.
    GetClientCertificate func(serverHello *ServerHelloInfo) (*Certificate, error)
    :
}

:
// If no client certs are available in Config and the
// GetClientCertificate callback is defined, get a
// certificate from the callback function.
//
// It is the responsibility of the callback to return
// an appropriate certificate.
if c.config.Certificates == nil && c.config.GetClientCertificate != nil {
    hello := &ServerHelloInfo{
        CertCAs:   certReq.certificateAuthorities,
        CertTypes: certReq.certificateTypes,
    }
    if chainToSend, err = c.config.GetClientCertificate(hello); err != nil {
        return err
    }
} else {
    // We need to search our list of client certs for one
    // where SignatureAlgorithm is acceptable to the server and the
    // Issuer is in certReq.certificateAuthorities
    findCert:
        for i, chain := range c.config.Certificates {
            :
        }
}

:
case "Time", "GetCertificate", "GetClientCertificate":
: