docs: private X509Certificate createCACert(PublicKey publicKey, PrivateKey privateKey) throws Exception {
  
          // signers name
          X500Name issuerName = new X500Name("CN=www.mockserver.com, O=MockServer, L=London, ST=England, C=UK");
  
          // subjects name - the same as we are self signed.
          X500Name subjectName = issuerName;
  
          // serial
          BigInteger serial = BigInteger.valueOf(new Random().nextInt(Integer.MAX_VALUE));
  
          // create the certificate - version 3
          X509v3CertificateBuilder builder = new JcaX509v3CertificateBuilder(issuerName, serial, NOT_BEFORE, NOT_AFTER, subjectName, publicKey);
          builder.addExtension(Extension.subjectKeyIdentifier, false, createSubjectKeyIdentifier(publicKey));
          builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true));
  
          KeyUsage usage = new KeyUsage(KeyUsage.keyCertSign | KeyUsage.digitalSignature | KeyUsage.keyEncipherment | KeyUsage.dataEncipherment | KeyUsage.cRLSign);
          builder.addExtension(Extension.keyUsage, false, usage);
  
          ASN1EncodableVector purposes = new ASN1EncodableVector();
          purposes.add(KeyPurposeId.id_kp_serverAuth);
          purposes.add(KeyPurposeId.id_kp_clientAuth);
          purposes.add(KeyPurposeId.anyExtendedKeyUsage);
          builder.addExtension(Extension.extendedKeyUsage, false, new DERSequence(purposes));
  
          X509Certificate cert = signCertificate(builder, privateKey);
          cert.checkValidity(new Date());
          cert.verify(publicKey);
  
          return cert;
      }