import ssl


def build_ssl_context(local_certs_file: str, ca_certs_file: str, key_file: str, ):
    """
    :param local_certs_file: The filename of the certificate to present for authentication.
    :param ca_certs_file: The filename of the CA certificates as passed to ssl.SSLContext.load_verify_locations
    :param key_file: The filename of the private key for the certificate identified by local_certs_file.
    """
    # Ensure Client authentication
    ssl_ctx = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    ssl_ctx.load_cert_chain(local_certs_file, key_file)
    # The docs suggest we have to specify both that we must verify the client cert and the locations
    ssl_ctx.verify_mode = ssl.CERT_REQUIRED
    ssl_ctx.load_verify_locations(ca_certs_file)

    return ssl_ctx