code: func CacheManagedCertificate(domain string, cfg *Config) (Certificate, error) {
  	storage, err := cfg.StorageFor(cfg.CAUrl)
  	if err != nil {
  		return Certificate{}, err
  	}
  	siteData, err := storage.LoadSite(domain)
  	if err != nil {
  		return Certificate{}, err
  	}
  	cert, err := makeCertificate(siteData.Cert, siteData.Key)
  	if err != nil {
  		return cert, err
  	}
  	cert.Config = cfg
  	cacheCertificate(cert)
  	return cert, nil
  }
docs: // CacheManagedCertificate loads the certificate for domain into the
  // cache, flagging it as Managed and, if onDemand is true, as "OnDemand"
  // (meaning that it was obtained or loaded during a TLS handshake).
  //
  // This function is safe for concurrent use.