crypto/tls: document VerifyPeerCertificate behavior in relation to ClientAuth

Change-Id: I3ff478912a5a178492d544d2f4ee9cc7570d9acc
Reviewed-on: https://go-review.googlesource.com/84475
Reviewed-by: Filippo Valsorda <hi@filippo.io>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

diff --git a/src/crypto/tls/common.go b/src/crypto/tls/common.go
index d4b0286b85392946c8641c18cf355a94b14545e3..646b107958ac4c7fdf83199f7bef8eecf1db1ef5 100644 (file)
--- a/src/crypto/tls/common.go
+++ b/src/crypto/tls/common.go
@@ -406,8 +406,9 @@ type Config struct {
        //
        // If normal verification fails then the handshake will abort before
        // considering this callback. If normal verification is disabled by
-       // setting InsecureSkipVerify then this callback will be considered but
-       // the verifiedChains argument will always be nil.
+       // setting InsecureSkipVerify, or (for a server) when ClientAuth is
+       // RequestClientCert or RequireAnyClientCert, then this callback will
+       // be considered but the verifiedChains argument will always be nil.
        VerifyPeerCertificate func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error
 
        // RootCAs defines the set of root certificate authorities