}
	if x509.IsEncryptedPEMBlock(key) {
		password := env.Get(EnvCertPassword, "")
		if len(password) == 0 {
			return tls.Certificate{}, ErrTLSNoPassword(nil)
		}
		decryptedKey, decErr := x509.DecryptPEMBlock(key, []byte(password))
		if decErr != nil {
			return tls.Certificate{}, ErrTLSWrongPassword(decErr)
		}
		keyPEMBlock = pem.EncodeToMemory(&pem.Block{Type: key.Type, Bytes: decryptedKey})
	}

				}
				if x509.IsEncryptedPEMBlock(privateKeyPEM) {
					keyBytes, err = x509.DecryptPEMBlock(privateKeyPEM, []byte(env.Get(EnvKESClientPassword, "")))
					if err != nil {
						return tls.Certificate{}, fmt.Errorf("Unable to decrypt KES client private key as specified by the shell environment: %v", err)
					}

pkg crypto/tls, type ConnectionState struct, NegotiatedProtocolIsMutual //deprecated
pkg crypto/tls, type ConnectionState struct, TLSUnique //deprecated
pkg crypto/x509, func DecryptPEMBlock //deprecated
pkg crypto/x509, func EncryptPEMBlock //deprecated
pkg crypto/x509, func IsEncryptedPEMBlock //deprecated
pkg crypto/x509, type CertificateRequest struct, Attributes //deprecated

pkg crypto/x509, const SHA512WithRSA = 6
pkg crypto/x509, const TooManyIntermediates = 3
pkg crypto/x509, const UnknownPublicKeyAlgorithm = 0
pkg crypto/x509, const UnknownSignatureAlgorithm = 0
pkg crypto/x509, func DecryptPEMBlock(*pem.Block, []uint8) ([]uint8, error)
pkg crypto/x509, func EncryptPEMBlock(io.Reader, string, []uint8, []uint8, PEMCipher) (*pem.Block, error)
pkg crypto/x509, func IsEncryptedPEMBlock(*pem.Block) bool