code: func (c *Config) getCertificate(clientHello *ClientHelloInfo) (*Certificate, error) {
  	if c.GetCertificate != nil &&
  		(len(c.Certificates) == 0 || len(clientHello.ServerName) > 0) {
  		cert, err := c.GetCertificate(clientHello)
  		if cert != nil || err != nil {
  			return cert, err
  		}
  	}
  
  	if len(c.Certificates) == 0 {
  		return nil, errors.New("crypto/tls: no certificates configured")
  	}
  
  	if len(c.Certificates) == 1 || c.NameToCertificate == nil {
  		// There's only one choice, so no point doing any work.
  		return &c.Certificates[0], nil
  	}
  
  	name := strings.ToLower(clientHello.ServerName)
  	for len(name) > 0 && name[len(name)-1] == '.' {
  		name = name[:len(name)-1]
  	}
  
  	if cert, ok := c.NameToCertificate[name]; ok {
  		return cert, nil
  	}
  
  	// try replacing labels in the name with wildcards until we get a
  	// match.
  	labels := strings.Split(name, ".")
  	for i := range labels {
  		labels[i] = "*"
  		candidate := strings.Join(labels, ".")
  		if cert, ok := c.NameToCertificate[candidate]; ok {
  			return cert, nil
  		}
  	}
  
  	// If nothing matches, return the first certificate.
  	return &c.Certificates[0], nil
  }
docs: // getCertificate returns the best certificate for the given ClientHelloInfo,
  // defaulting to the first element of c.Certificates.