by mfischer@zendesk.com:

The serve() function of net/http calls tlsConn.Handshake() if a TLS connection is used,
but fails to expose any handshake errors that would be useful for debugging.  

if err := tlsConn.Handshake(); err != nil {                
        return
}

This makes it impossible for a user of net/http's Serve() methods to report handshake
errors such as bad certificates, bad protocol versions, etc.