code: func (cg configGroup) handshakeMaintenance(name string, cert Certificate) (Certificate, error) {
  	// Check cert expiration
  	timeLeft := cert.NotAfter.Sub(time.Now().UTC())
  	if timeLeft < RenewDurationBefore {
  		log.Printf("[INFO] Certificate for %v expires in %v; attempting renewal", cert.Names, timeLeft)
  		return cg.renewDynamicCertificate(name, cert.Config)
  	}
  
  	// Check OCSP staple validity
  	if cert.OCSP != nil {
  		refreshTime := cert.OCSP.ThisUpdate.Add(cert.OCSP.NextUpdate.Sub(cert.OCSP.ThisUpdate) / 2)
  		if time.Now().After(refreshTime) {
  			err := stapleOCSP(&cert, nil)
  			if err != nil {
  				// An error with OCSP stapling is not the end of the world, and in fact, is
  				// quite common considering not all certs have issuer URLs that support it.
  				log.Printf("[ERROR] Getting OCSP for %s: %v", name, err)
  			}
  			certCacheMu.Lock()
  			certCache[name] = cert
  			certCacheMu.Unlock()
  		}
  	}
  
  	return cert, nil
  }
docs: // handshakeMaintenance performs a check on cert for expiration and OCSP
  // validity.
  //
  // This function is safe for use by multiple concurrent goroutines.