Thanks. I got it to do what I needed using that VerifyPeerCertificate along with setting ClientAuth to tls.RequireAnyClientCert:
var tlsConf = &tls.Config{
VerifyPeerCertificate: validateCert,
ClientAuth: tls.RequireAnyClientCert,
}