code: func GetNamedCertificateMap(certs []NamedTLSCert) (map[string]*tls.Certificate, error) {
  	// register certs with implicit names first, reverse order such that earlier trump over the later
  	byName := map[string]*tls.Certificate{}
  	for i := len(certs) - 1; i >= 0; i-- {
  		if len(certs[i].Names) > 0 {
  			continue
  		}
  		cert := &certs[i].TLSCert
  
  		// read names from certificate common names and DNS names
  		if len(cert.Certificate) == 0 {
  			return nil, fmt.Errorf("empty SNI certificate, skipping")
  		}
  		x509Cert, err := x509.ParseCertificate(cert.Certificate[0])
  		if err != nil {
  			return nil, fmt.Errorf("parse error for SNI certificate: %v", err)
  		}
  		cn := x509Cert.Subject.CommonName
  		if cn == "*" || len(validation.IsDNS1123Subdomain(strings.TrimPrefix(cn, "*."))) == 0 {
  			byName[cn] = cert
  		}
  		for _, san := range x509Cert.DNSNames {
  			byName[san] = cert
  		}
  		// intentionally all IPs in the cert are ignored as SNI forbids passing IPs
  		// to select a cert. Before go 1.6 the tls happily passed IPs as SNI values.
  	}
  
  	// register certs with explicit names last, overwriting every of the implicit ones,
  	// again in reverse order.
  	for i := len(certs) - 1; i >= 0; i-- {
  		namedCert := &certs[i]
  		for _, name := range namedCert.Names {
  			byName[name] = &certs[i].TLSCert
  		}
  	}
  
  	return byName, nil
  }
docs: // GetNamedCertificateMap returns a map of *tls.Certificate by name. It's
  // suitable for use in tls.Config#NamedCertificates. Returns an error if any of the certs
  // cannot be loaded. Returns nil if len(certs) == 0