code: func (c *ConsulProvider) generateCA(privateKey string, sn uint64) (string, error) {
  	state := c.Delegate.State()
  	_, config, err := state.CAConfig()
  	if err != nil {
  		return "", err
  	}
  
  	privKey, err := connect.ParseSigner(privateKey)
  	if err != nil {
  		return "", fmt.Errorf("error parsing private key %q: %s", privateKey, err)
  	}
  
  	name := fmt.Sprintf("Consul CA %d", sn)
  
  	// The URI (SPIFFE compatible) for the cert
  	id := connect.SpiffeIDSigningForCluster(config)
  	keyId, err := connect.KeyId(privKey.Public())
  	if err != nil {
  		return "", err
  	}
  
  	// Create the CA cert
  	serialNum := &big.Int{}
  	serialNum.SetUint64(sn)
  	template := x509.Certificate{
  		SerialNumber:          serialNum,
  		Subject:               pkix.Name{CommonName: name},
  		URIs:                  []*url.URL{id.URI()},
  		BasicConstraintsValid: true,
  		KeyUsage: x509.KeyUsageCertSign |
  			x509.KeyUsageCRLSign |
  			x509.KeyUsageDigitalSignature,
  		IsCA:           true,
  		NotAfter:       time.Now().AddDate(10, 0, 0),
  		NotBefore:      time.Now(),
  		AuthorityKeyId: keyId,
  		SubjectKeyId:   keyId,
  	}
  
  	bs, err := x509.CreateCertificate(
  		rand.Reader, &template, &template, privKey.Public(), privKey)
  	if err != nil {
  		return "", fmt.Errorf("error generating CA certificate: %s", err)
  	}
  
  	var buf bytes.Buffer
  	err = pem.Encode(&buf, &pem.Block{Type: "CERTIFICATE", Bytes: bs})
  	if err != nil {
  		return "", fmt.Errorf("error encoding private key: %s", err)
  	}
  
  	return buf.String(), nil
  }
docs: // generateCA makes a new root CA using the current private key