code: func (c *Certifier) Obtain(request ObtainRequest) (*Resource, error) {
  	if len(request.Domains) == 0 {
  		return nil, errors.New("no domains to obtain a certificate for")
  	}
  
  	domains := sanitizeDomain(request.Domains)
  
  	if request.Bundle {
  		log.Infof("[%s] acme: Obtaining bundled SAN certificate", strings.Join(domains, ", "))
  	} else {
  		log.Infof("[%s] acme: Obtaining SAN certificate", strings.Join(domains, ", "))
  	}
  
  	order, err := c.core.Orders.New(domains)
  	if err != nil {
  		return nil, err
  	}
  
  	authz, err := c.getAuthorizations(order)
  	if err != nil {
  		// If any challenge fails, return. Do not generate partial SAN certificates.
  		c.deactivateAuthorizations(order)
  		return nil, err
  	}
  
  	err = c.resolver.Solve(authz)
  	if err != nil {
  		// If any challenge fails, return. Do not generate partial SAN certificates.
  		c.deactivateAuthorizations(order)
  		return nil, err
  	}
  
  	log.Infof("[%s] acme: Validations succeeded; requesting certificates", strings.Join(domains, ", "))
  
  	failures := make(obtainError)
  	cert, err := c.getForOrder(domains, order, request.Bundle, request.PrivateKey, request.MustStaple)
  	if err != nil {
  		for _, auth := range authz {
  			failures[challenge.GetTargetedDomain(auth)] = err
  		}
  	}
  
  	// Do not return an empty failures map, because
  	// it would still be a non-nil error value
  	if len(failures) > 0 {
  		return cert, failures
  	}
  	return cert, nil
  }
docs: // Obtain tries to obtain a single certificate using all domains passed into it.
  //
  // This function will never return a partial certificate.
  // If one domain in the list fails, the whole certificate will fail.