code: func CertURIFromConn(conn net.Conn) (connect.CertURI, error) {
  	tc, ok := conn.(*tls.Conn)
  	if !ok {
  		return nil, fmt.Errorf("invalid non-TLS connect client")
  	}
  	gotURI, err := extractCertURI(tc.ConnectionState().PeerCertificates)
  	if err != nil {
  		return nil, err
  	}
  	return connect.ParseCertURI(gotURI)
  }
docs: // CertURIFromConn is a helper to extract the service identifier URI from a
  // net.Conn. If the net.Conn is not a *tls.Conn then an error is always
  // returned. If the *tls.Conn didn't present a valid connect certificate, or is
  // not yet past the handshake, an error is returned.