code: func GetCertChecker(c context.Context, cn string) (*CertChecker, error) {
  	checker, err := certCheckerCache.LRU(c).GetOrCreate(c, cn, func() (interface{}, time.Duration, error) {
  		// To avoid storing CertChecker for non-existent CAs in local memory forever,
  		// we do a datastore check when creating the checker. It happens once during
  		// the process lifetime.
  		switch exists, err := ds.Exists(c, ds.NewKey(c, "CA", cn, 0, nil)); {
  		case err != nil:
  			return nil, 0, transient.Tag.Apply(err)
  		case !exists.All():
  			return nil, 0, Error{
  				error:  fmt.Errorf("no such CA %q", cn),
  				Reason: NoSuchCA,
  			}
  		}
  		return &CertChecker{
  			CN:  cn,
  			CRL: certconfig.NewCRLChecker(cn, certconfig.CRLShardCount, refetchCRLPeriod(c)),
  		}, 0, nil
  	})
  	if err != nil {
  		return nil, err
  	}
  	return checker.(*CertChecker), nil
  }
docs: // GetCertChecker returns an instance of CertChecker for given CA.
  //
  // It caches CertChecker objects in local memory and reuses them between
  // requests.