docs: def create_ca(self, name, ca_name='', cert_type=crypto.TYPE_RSA, bits=2048,
                    alt_names=None, years=5, serial=0, pathlen=0,
                    overwrite=False):
          """
          Create a certificate authority
  
          Arguments: name     - The name of the CA
                     cert_type - The type of the cert. TYPE_RSA or TYPE_DSA
                     bits     - The number of bits to use
                     alt_names - An array of alternative names in the format:
                                 IP:address, DNS:address
          Returns:   KeyCertPair for the new CA
          """
  
          cakey = self.create_key_pair(cert_type, bits)
          req = self.create_request(cakey, CN=name)
          signing_key = cakey
          signing_cert = req
  
          parent_ca = ''
          if ca_name:
              ca_bundle = self.store.get_files(ca_name)
              signing_key = ca_bundle.key.load()
              signing_cert = ca_bundle.cert.load()
              parent_ca = ca_bundle.cert.file_path
  
          basicConstraints = "CA:true"
          # If pathlen is exactly 0, this CA cannot sign intermediaries.
          # A negative value leaves this out entirely and allows arbitrary
          # numbers of intermediates.
          if pathlen >=0:
              basicConstraints += ', pathlen:' + str(pathlen)
  
          extensions = [
              crypto.X509Extension(
                  b"basicConstraints", True, basicConstraints.encode()),
              crypto.X509Extension(
                  b"keyUsage", True, b"keyCertSign, cRLSign"),
              crypto.X509Extension(
                  b"extendedKeyUsage", True, b"serverAuth, clientAuth"),
              lambda cert: crypto.X509Extension(
                  b"subjectKeyIdentifier", False, b"hash", subject=cert),
              lambda cert: crypto.X509Extension(
                  b"authorityKeyIdentifier", False, b"keyid:always",
                  issuer=cert),
          ]
  
          if alt_names:
              extensions.append(
                  crypto.X509Extension(b"subjectAltName",
                                       False, ",".join(alt_names).encode())
              )
  
          # TODO: start time before today for clock skew?
          cacert = self.sign(
              req, (signing_cert, signing_key), (0, 60*60*24*365*years),
              extensions=extensions)
  
          x509s = {'key': cakey, 'cert': cacert, 'ca': cacert}
          self.store.add_files(name, x509s, overwrite=overwrite,
                               parent_ca=parent_ca, is_ca=True)
          if ca_name:
              self.store.add_sign_link(ca_name, name)
          return self.store.get_record(name)