code: func (c CertificateStore) GetBestCertificate(clientHello *tls.ClientHelloInfo) *tls.Certificate {
  	domainToCheck := strings.ToLower(strings.TrimSpace(clientHello.ServerName))
  	if len(domainToCheck) == 0 {
  		// If no ServerName is provided, Check for local IP address matches
  		host, _, err := net.SplitHostPort(clientHello.Conn.LocalAddr().String())
  		if err != nil {
  			log.Debugf("Could not split host/port: %v", err)
  		}
  		domainToCheck = strings.TrimSpace(host)
  	}
  
  	if cert, ok := c.CertCache.Get(domainToCheck); ok {
  		return cert.(*tls.Certificate)
  	}
  
  	matchedCerts := map[string]*tls.Certificate{}
  	if c.DynamicCerts != nil && c.DynamicCerts.Get() != nil {
  		for domains, cert := range c.DynamicCerts.Get().(map[string]*tls.Certificate) {
  			for _, certDomain := range strings.Split(domains, ",") {
  				if MatchDomain(domainToCheck, certDomain) {
  					matchedCerts[certDomain] = cert
  				}
  			}
  		}
  	}
  
  	if len(matchedCerts) > 0 {
  		// sort map by keys
  		keys := make([]string, 0, len(matchedCerts))
  		for k := range matchedCerts {
  			keys = append(keys, k)
  		}
  		sort.Strings(keys)
  
  		// cache best match
  		c.CertCache.SetDefault(domainToCheck, matchedCerts[keys[len(keys)-1]])
  		return matchedCerts[keys[len(keys)-1]]
  	}
  
  	return nil
  }
docs: // GetBestCertificate returns the best match certificate, and caches the response