code: func (cfg *dynamicTLSConfig) Get(v verifierFunc) *tls.Config {
  	cfg.RLock()
  	defer cfg.RUnlock()
  	copy := cfg.base.Clone()
  	copy.RootCAs = cfg.roots
  	copy.ClientCAs = cfg.roots
  	if v != nil {
  		copy.VerifyPeerCertificate = func(rawCerts [][]byte, chains [][]*x509.Certificate) error {
  			return v(cfg.Get(nil), rawCerts)
  		}
  	}
  	copy.GetCertificate = func(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
  		leaf := cfg.Leaf()
  		if leaf == nil {
  			return nil, errors.New("tls: no certificates configured")
  		}
  		return leaf, nil
  	}
  	copy.GetClientCertificate = func(_ *tls.CertificateRequestInfo) (*tls.Certificate, error) {
  		leaf := cfg.Leaf()
  		if leaf == nil {
  			return nil, errors.New("tls: no certificates configured")
  		}
  		return leaf, nil
  	}
  	copy.GetConfigForClient = func(*tls.ClientHelloInfo) (*tls.Config, error) {
  		return cfg.Get(v), nil
  	}
  	return copy
  }
docs: // Get fetches the lastest tls.Config with all the hooks attached to keep it
  // loading the most recent roots and certs even after future changes to cfg.
  //
  // The verifierFunc passed will be attached to the config returned such that it
  // runs with the _latest_ config object returned passed to it. That means that a
  // client can use this config for a long time and will still verify against the
  // latest roots even though the roots in the struct is has can't change.