code: func ChallengeBlocks(domain, keyAuth string) ([]byte, []byte, error) {
  	// Compute the SHA-256 digest of the key authorization.
  	zBytes := sha256.Sum256([]byte(keyAuth))
  
  	value, err := asn1.Marshal(zBytes[:sha256.Size])
  	if err != nil {
  		return nil, nil, err
  	}
  
  	// Add the keyAuth digest as the acmeValidation-v1 extension
  	// (marked as critical such that it won't be used by non-ACME software).
  	// Reference: https://tools.ietf.org/html/draft-ietf-acme-tls-alpn-05#section-3
  	extensions := []pkix.Extension{
  		{
  			Id:       idPeAcmeIdentifierV1,
  			Critical: true,
  			Value:    value,
  		},
  	}
  
  	// Generate a new RSA key for the certificates.
  	tempPrivateKey, err := certcrypto.GeneratePrivateKey(certcrypto.RSA2048)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	rsaPrivateKey := tempPrivateKey.(*rsa.PrivateKey)
  
  	// Generate the PEM certificate using the provided private key, domain, and extra extensions.
  	tempCertPEM, err := certcrypto.GeneratePemCert(rsaPrivateKey, domain, extensions)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	// Encode the private key into a PEM format. We'll need to use it to generate the x509 keypair.
  	rsaPrivatePEM := certcrypto.PEMEncode(rsaPrivateKey)
  
  	return tempCertPEM, rsaPrivatePEM, nil
  }
docs: // ChallengeBlocks returns PEM blocks (certPEMBlock, keyPEMBlock) with the acmeValidation-v1 extension
  // and domain name for the `tls-alpn-01` challenge.