There's no need to PEM-encode key/cert pair to create a tls.Certificate. All tls.X509KeyPair does is decode back to DER and verify that the key corresponds to the cert. But we already know it does. Change-Id: Icccdaf7fd86317147476fb03cbc71ee7b4a06edb Reviewed-on: https://go-review.googlesource.com/26694 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>