code: func (s *Service) Dial(ctx context.Context, resolver Resolver) (net.Conn, error) {
  	addr, certURI, err := resolver.Resolve(ctx)
  	if err != nil {
  		return nil, err
  	}
  	s.logger.Printf("[DEBUG] resolved service instance: %s (%s)", addr,
  		certURI.URI())
  	var dialer net.Dialer
  	tcpConn, err := dialer.DialContext(ctx, "tcp", addr)
  	if err != nil {
  		return nil, err
  	}
  
  	tlsConn := tls.Client(tcpConn, s.tlsCfg.Get(clientSideVerifier))
  	// Set deadline for Handshake to complete.
  	deadline, ok := ctx.Deadline()
  	if ok {
  		tlsConn.SetDeadline(deadline)
  	}
  	// Perform handshake
  	if err = tlsConn.Handshake(); err != nil {
  		tlsConn.Close()
  		return nil, err
  	}
  	// Clear deadline since that was only for connection. Caller can set their own
  	// deadline later as necessary.
  	tlsConn.SetDeadline(time.Time{})
  
  	// Verify that the connect server's URI matches certURI
  	err = verifyServerCertMatchesURI(tlsConn.ConnectionState().PeerCertificates,
  		certURI)
  	if err != nil {
  		tlsConn.Close()
  		return nil, err
  	}
  	s.logger.Printf("[DEBUG] successfully connected to %s (%s)", addr,
  		certURI.URI())
  	return tlsConn, nil
  }
docs: // Dial connects to a remote Connect-enabled server. The passed Resolver is used
  // to discover a single candidate instance which will be dialed and have it's
  // TLS certificate verified against the expected identity. Failures are returned
  // directly with no retries. Repeated dials may use different instances
  // depending on the Resolver implementation.
  //
  // Timeout can be managed via the Context.
  //
  // Calls to Dial made before the Service has loaded certificates from the agent
  // will fail. You can prevent this by using Ready or ReadyWait in app during
  // startup.