are you sure this is working as expected?

From golang docs:

> // ClientCAs defines the set of root certificate authorities
> // that servers use if required to verify a client certificate
> // by the policy in ClientAuth.
> ClientCAs *x509.CertPool
>
> // RootCAs defines the set of root certificate authorities
> // that clients use when verifying server certificates.
> // If RootCAs is nil, TLS uses the host's root CA set.
> RootCAs *x509.CertPool

It seems like this (server) should be using `ClientCAs`?