code: func (s *Service) ServerTLSConfig() *tls.Config {
  	return s.tlsCfg.Get(newServerSideVerifier(s.client, s.service))
  }
docs: // ServerTLSConfig returns a *tls.Config that allows any TCP listener to accept
  // and authorize incoming Connect clients. It will return a single static config
  // with hooks to dynamically load certificates, and perform Connect
  // authorization during verification. Service implementations do not need to
  // reload this to get new certificates.
  //
  // At any time it may be possible that the Service instance does not have access
  // to usable certificates due to not being initially setup yet or a prolonged
  // error during renewal. The listener will be able to accept connections again
  // once connectivity is restored provided the client's Token is valid.
  //
  // To prevent routing traffic to the app instance while it's certificates are
  // invalid or not populated yet you may use Ready in a health check endpoint
  // and/or ReadyWait during startup before starting the TLS listener. The latter
  // only prevents connections during initial bootstrap (including permission
  // issues where certs can never be issued due to bad credentials) but won't
  // handle the case that certificates expire and an error prevents timely
  // renewal.