code: func Update(ca *x509.Certificate, priv crypto.Signer) (cert []byte, err error) {
  	copy, err := x509.ParseCertificate(ca.Raw)
  	if err != nil {
  		return
  	}
  
  	validity := ca.NotAfter.Sub(ca.NotBefore)
  	copy.NotBefore = time.Now().Round(time.Minute).Add(-5 * time.Minute)
  	copy.NotAfter = copy.NotBefore.Add(validity)
  	cert, err = x509.CreateCertificate(rand.Reader, copy, copy, priv.Public(), priv)
  	if err != nil {
  		return
  	}
  
  	cert = pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert})
  	return
  }
docs: // Update copies the CA certificate, updates the NotBefore and
  // NotAfter fields, and then re-signs the certificate.