code: func getCertificate(name string) (cert Certificate, matched, defaulted bool) {
  	var ok bool
  
  	// Not going to trim trailing dots here since RFC 3546 says,
  	// "The hostname is represented ... without a trailing dot."
  	// Just normalize to lowercase.
  	name = strings.ToLower(name)
  
  	certCacheMu.RLock()
  	defer certCacheMu.RUnlock()
  
  	// exact match? great, let's use it
  	if cert, ok = certCache[name]; ok {
  		matched = true
  		return
  	}
  
  	// try replacing labels in the name with wildcards until we get a match
  	labels := strings.Split(name, ".")
  	for i := range labels {
  		labels[i] = "*"
  		candidate := strings.Join(labels, ".")
  		if cert, ok = certCache[candidate]; ok {
  			matched = true
  			return
  		}
  	}
  
  	// if nothing matches, use the default certificate or bust
  	cert, defaulted = certCache[""]
  	return
  }
docs: // getCertificate gets a certificate that matches name (a server name)
  // from the in-memory cache. If there is no exact match for name, it
  // will be checked against names of the form '*.example.com' (wildcard
  // certificates) according to RFC 6125. If a match is found, matched will
  // be true. If no matches are found, matched will be false and a default
  // certificate will be returned with defaulted set to true. If no default
  // certificate is set, defaulted will be set to false.
  //
  // The logic in this function is adapted from the Go standard library,
  // which is by the Go Authors.
  //
  // This function is safe for concurrent use.