errors.New since formatting is not required.
ClientCAs pool is needed for client verification

Avoid using the system CAs for client verification.