code: func (m *manager) certSatisfiesTemplateLocked() bool {
  	if m.cert == nil {
  		return false
  	}
  
  	if template := m.getTemplate(); template != nil {
  		if template.Subject.CommonName != m.cert.Leaf.Subject.CommonName {
  			klog.V(2).Infof("Current certificate CN (%s) does not match requested CN (%s)", m.cert.Leaf.Subject.CommonName, template.Subject.CommonName)
  			return false
  		}
  
  		currentDNSNames := sets.NewString(m.cert.Leaf.DNSNames...)
  		desiredDNSNames := sets.NewString(template.DNSNames...)
  		missingDNSNames := desiredDNSNames.Difference(currentDNSNames)
  		if len(missingDNSNames) > 0 {
  			klog.V(2).Infof("Current certificate is missing requested DNS names %v", missingDNSNames.List())
  			return false
  		}
  
  		currentIPs := sets.NewString()
  		for _, ip := range m.cert.Leaf.IPAddresses {
  			currentIPs.Insert(ip.String())
  		}
  		desiredIPs := sets.NewString()
  		for _, ip := range template.IPAddresses {
  			desiredIPs.Insert(ip.String())
  		}
  		missingIPs := desiredIPs.Difference(currentIPs)
  		if len(missingIPs) > 0 {
  			klog.V(2).Infof("Current certificate is missing requested IP addresses %v", missingIPs.List())
  			return false
  		}
  
  		currentOrgs := sets.NewString(m.cert.Leaf.Subject.Organization...)
  		desiredOrgs := sets.NewString(template.Subject.Organization...)
  		missingOrgs := desiredOrgs.Difference(currentOrgs)
  		if len(missingOrgs) > 0 {
  			klog.V(2).Infof("Current certificate is missing requested orgs %v", missingOrgs.List())
  			return false
  		}
  	}
  
  	return true
  }
docs: // Check that the current certificate on disk satisfies the requests from the
  // current template.
  //
  // Note that extra items in the certificate's SAN or orgs that don't exist in
  // the template will not trigger a renewal.
  //
  // Requires certAccessLock to be locked.