code: func (m *Manager) Cert(host string) (*tls.Certificate, error) {
  	host = strings.ToLower(host)
  	if debug {
  		log.Printf("Cert %s", host)
  	}
  
  	m.init()
  	m.mu.Lock()
  	if !m.registered() {
  		m.register("", nil)
  	}
  
  	ok := false
  	if m.state.Hosts == nil {
  		ok = true
  	} else {
  		for _, h := range m.state.Hosts {
  			if host == h {
  				ok = true
  				break
  			}
  		}
  	}
  	if !ok {
  		m.mu.Unlock()
  		return nil, fmt.Errorf("unknown host")
  	}
  
  	// Otherwise look in our cert cache.
  	entry, ok := m.certCache[host]
  	if !ok {
  		r := m.rateLimit.Reserve()
  		ok := r.OK()
  		if ok {
  			ok = m.newHostLimit.Allow()
  			if !ok {
  				r.Cancel()
  			}
  		}
  		if !ok {
  			m.mu.Unlock()
  			return nil, fmt.Errorf("rate limited")
  		}
  		entry = &cacheEntry{host: host, m: m}
  		m.certCache[host] = entry
  	}
  	m.mu.Unlock()
  
  	entry.mu.Lock()
  	defer entry.mu.Unlock()
  	entry.init()
  	if entry.err != nil {
  		return nil, entry.err
  	}
  	return entry.cert, nil
  }
docs: // Cert returns the certificate for the given host name, obtaining a new one if necessary.
  //
  // As noted in the documentation for Manager and for the GetCertificate method,
  // obtaining a certificate requires that m.GetCertificate be associated with host.
  // In most servers, simply starting a TLS server with a configuration referring
  // to m.GetCertificate is sufficient, and Cert need not be called.
  //
  // The main use of Cert is to force the manager to obtain a certificate
  // for a particular host name ahead of time.