code: func GenerateCA(signer crypto.Signer, sn *big.Int, days int, constraints []string) (string, error) {
  	id, err := keyID(signer.Public())
  	if err != nil {
  		return "", err
  	}
  
  	name := fmt.Sprintf("Consul Agent CA %d", sn)
  
  	// Create the CA cert
  	template := x509.Certificate{
  		SerialNumber: sn,
  		Subject: pkix.Name{
  			Country:       []string{"US"},
  			PostalCode:    []string{"94105"},
  			Province:      []string{"CA"},
  			Locality:      []string{"San Francisco"},
  			StreetAddress: []string{"101 Second Street"},
  			Organization:  []string{"HashiCorp Inc."},
  			CommonName:    name,
  		},
  		BasicConstraintsValid: true,
  		KeyUsage:              x509.KeyUsageCertSign | x509.KeyUsageCRLSign | x509.KeyUsageDigitalSignature,
  		IsCA:                  true,
  		NotAfter:              time.Now().AddDate(0, 0, days),
  		NotBefore:             time.Now(),
  		AuthorityKeyId:        id,
  		SubjectKeyId:          id,
  	}
  
  	if len(constraints) > 0 {
  		template.PermittedDNSDomainsCritical = true
  		template.PermittedDNSDomains = constraints
  	}
  	bs, err := x509.CreateCertificate(
  		rand.Reader, &template, &template, signer.Public(), signer)
  	if err != nil {
  		return "", fmt.Errorf("error generating CA certificate: %s", err)
  	}
  
  	var buf bytes.Buffer
  	err = pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: bs})
  	if err != nil {
  		return "", fmt.Errorf("error encoding private key: %s", err)
  	}
  
  	return buf.String(), nil
  }
docs: // GenerateCA generates a new CA for agent TLS (not to be confused with Connect TLS)