code: func verifyServerCertMatchesURI(certs []*x509.Certificate,
  	expected connect.CertURI) error {
  	expectedStr := expected.URI().String()
  
  	gotURI, err := extractCertURI(certs)
  	if err != nil {
  		return errors.New("peer certificate mismatch")
  	}
  
  	// Override the hostname since we rely on x509 constraints to limit ability to
  	// spoof the trust domain if needed (i.e. because a root is shared with other
  	// PKI or Consul clusters). This allows for seamless migrations between trust
  	// domains.
  	expectURI := expected.URI()
  	expectURI.Host = gotURI.Host
  	if strings.ToLower(gotURI.String()) == strings.ToLower(expectURI.String()) {
  		// OK!
  		return nil
  	}
  
  	return fmt.Errorf("peer certificate mismatch got %s, want %s",
  		gotURI.String(), expectedStr)
  }
docs: // verifyServerCertMatchesURI is used on tls connections dialed to a connect
  // server to ensure that the certificate it presented has the correct identity.