code: func (ch *CertChecker) refetchCA(c context.Context) (*certconfig.CA, error) {
  	ca := &certconfig.CA{CN: ch.CN}
  	switch err := ds.Get(c, ca); {
  	case err == ds.ErrNoSuchEntity:
  		return nil, nil
  	case err != nil:
  		return nil, transient.Tag.Apply(err)
  	}
  
  	parsedConf, err := ca.ParseConfig()
  	if err != nil {
  		return nil, fmt.Errorf("can't parse stored config for %q - %s", ca.CN, err)
  	}
  	ca.ParsedConfig = parsedConf
  
  	parsedCert, err := x509.ParseCertificate(ca.Cert)
  	if err != nil {
  		return nil, fmt.Errorf("can't parse stored cert for %q - %s", ca.CN, err)
  	}
  	ca.ParsedCert = parsedCert
  
  	return ca, nil
  }
docs: // refetchCA is called lazily whenever we need to fetch the CA entity.
  //
  // If CA entity has disappeared since CertChecker was created, it returns nil
  // (that will be cached in ch.ca as usual). It acts as an indicator to GetCA to
  // return NoSuchCA error, since returning a error here would just cause a retry
  // of 'refetchCA' later.