Use GetClientCertificate to ensure client certificate is sent

[ramondeklein]

It looks like tls.Config.Certificates will not always send the client certificate.

The Go TLS code contains the following:

func (c *Conn) getClientCertificate(cri *CertificateRequestInfo) (*Certificate, error) {
	if c.config.GetClientCertificate != nil {
		return c.config.GetClientCertificate(cri)
	}

	for _, chain := range c.config.Certificates {
		if err := cri.SupportsCertificate(&chain); err != nil {
			continue
		}
		return &chain, nil
	}

	// No acceptable certificate found. Don't send a certificate.
	return new(Certificate), nil
}

So if the certificate doesn't match the conditions in cri.SupportsCertificate, then it won't be sent.