func GetClientCANames(apiHost string) ([]string, error) {
	acceptableCAs := []string{}
	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,  
		GetClientCertificate: func(hello *tls.CertificateRequestInfo) (*tls.Certificate, error) {
			acceptableCAs = []string{}
			for _, curr := range hello.AcceptableCAs {
				acceptableCAs = append(acceptableCAs, string(curr))
			}
			return &tls.Certificate{}, nil
		},
	}
	conn, err := tls.Dial("tcp", apiHost, tlsConfig)
	if err != nil {
		return nil, err
	}
	if err := conn.Close(); err != nil {
		return nil, err
	}
	return acceptableCAs, nil
}
GetClientCANames gets the CA names for client certs that a server accepts.  This is useful when inspecting the
state of particular servers.  apiHost is "host:port"
package cert
import (
	"crypto/tls"
	"crypto/x509"
	"fmt"
	"net/url"
	"strings"
)