code: func RenewFromSigner(ca *x509.Certificate, priv crypto.Signer) ([]byte, error) {
  	if !ca.IsCA {
  		return nil, errors.New("input certificate is not a CA cert")
  	}
  
  	// matching certificate public key vs private key
  	switch {
  	case ca.PublicKeyAlgorithm == x509.RSA:
  		var rsaPublicKey *rsa.PublicKey
  		var ok bool
  		if rsaPublicKey, ok = priv.Public().(*rsa.PublicKey); !ok {
  			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
  		}
  		if ca.PublicKey.(*rsa.PublicKey).N.Cmp(rsaPublicKey.N) != 0 {
  			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
  		}
  	case ca.PublicKeyAlgorithm == x509.ECDSA:
  		var ecdsaPublicKey *ecdsa.PublicKey
  		var ok bool
  		if ecdsaPublicKey, ok = priv.Public().(*ecdsa.PublicKey); !ok {
  			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
  		}
  		if ca.PublicKey.(*ecdsa.PublicKey).X.Cmp(ecdsaPublicKey.X) != 0 {
  			return nil, cferr.New(cferr.PrivateKeyError, cferr.KeyMismatch)
  		}
  	default:
  		return nil, cferr.New(cferr.PrivateKeyError, cferr.NotRSAOrECC)
  	}
  
  	req := csr.ExtractCertificateRequest(ca)
  	cert, _, err := NewFromSigner(req, priv)
  	return cert, err
  
  }
docs: // RenewFromSigner re-creates a root certificate from the CA cert and crypto.Signer.
  // The resulting root certificate will have ca certificate
  // as the template and have the same expiry length. E.g. the existing CA
  // is valid for a year from Jan 01 2015 to Jan 01 2016, the renewed certificate
  // will be valid from now and expire in one year as well.