code: func (cg configGroup) GetCertificate(clientHello *tls.ClientHelloInfo) (*tls.Certificate, error) {
  	cert, err := cg.getCertDuringHandshake(strings.ToLower(clientHello.ServerName), true, true)
  	return &cert.Certificate, err
  }
docs: // GetCertificate gets a certificate to satisfy clientHello. In getting
  // the certificate, it abides the rules and settings defined in the
  // Config that matches clientHello.ServerName. It first checks the in-
  // memory cache, then, if the config enables "OnDemand", it accesses
  // disk, then accesses the network if it must obtain a new certificate
  // via ACME.
  //
  // This method is safe for use as a tls.Config.GetCertificate callback.