certutils/certutils_pre_go18.go
func NewTLSConfig(level TLSConfigLevel) *tls.Config {
	// TLSConfigDefault - golang's default
	c := &tls.Config{}

	switch level {
	case TLSConfigIntermediate:
		// Causes servers to use Go's default ciphersuite preferences, which are tuned to avoid attacks. Does nothing on clients.
		c.PreferServerCipherSuites = true
		// Only use curves which have assembly implementations
		c.CurvePreferences = []tls.CurveID{
			tls.CurveP256,
		}
	case TLSConfigModern:
		// Modern compat sets TLS_1.2 minimum version and a set of ciphers that support PFS
		c.MinVersion = tls.VersionTLS12
		c.CipherSuites = []uint16{
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
		}
	}
	return c
}
func NewTLSConfig(level TLSConfigLevel) *tls.Config {
	// TLSConfigDefault - golang's default
	c := &tls.Config{}

	switch level {
	case TLSConfigIntermediate:
		// Causes servers to use Go's default ciphersuite preferences, which are tuned to avoid attacks. Does nothing on clients.
		c.PreferServerCipherSuites = true
		// Only use curves which have assembly implementations
		c.CurvePreferences = []tls.CurveID{
			tls.CurveP256,
		}
	case TLSConfigModern:
		// Modern compat sets TLS_1.2 minimum version and a set of ciphers that support PFS
		c.MinVersion = tls.VersionTLS12
		c.CipherSuites = []uint16{
			tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
			tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
			tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
		}
	}
	return c
}
// NewTLSConfig returns a *tls.Config that is pre-configured to match (roughly)
// the Mozilla recommended TLS specification. Different levels of security -vs- compatbility
// can be specified via the 'level' var.
//
// Based on: https://blog.gopheracademy.com/advent-2016/exposing-go-on-the-internet/
// Last updated: 2017-01-11