code: func (m *Manager) GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
  	m.init()
  
  	host := clientHello.ServerName
  
  	if debug {
  		log.Printf("GetCertificate %s", host)
  	}
  
  	if strings.HasSuffix(host, ".acme.invalid") {
  		m.mu.Lock()
  		cert := m.certTokens[host]
  		m.mu.Unlock()
  		if cert == nil {
  			return nil, fmt.Errorf("unknown host")
  		}
  		return cert, nil
  	}
  
  	return m.Cert(host)
  }
docs: // GetCertificate can be placed a tls.Config's GetCertificate field to make
  // the TLS server use Let's Encrypt certificates.
  // Each time a client connects to the TLS server expecting a new host name,
  // the TLS server's call to GetCertificate will trigger an exchange with the
  // Let's Encrypt servers to obtain that certificate, subject to the manager rate limits.
  //
  // As noted in the Manager's documentation comment,
  // to obtain a certificate for a given host name, that name
  // must resolve to a computer running a TLS server on port 443
  // that obtains TLS SNI certificates by calling m.GetCertificate.
  // In the standard usage, then, installing m.GetCertificate in the tls.Config
  // both automatically provisions the TLS certificates needed for
  // ordinary HTTPS service and answers the challenges from LetsEncrypt.org.