code: func importCA(c context.Context, ca *admin.CertificateAuthorityConfig, certPem string, rev string) error {
  	// Deserialize the cert and check its name matches the name in the config.
  	cert, certDer, err := decodeCACert(certPem)
  	if cert.Subject.CommonName != ca.Cn {
  		return fmt.Errorf("bad CN in the certificate, expecting %q, got %q", ca.Cn, cert.Subject.CommonName)
  	}
  
  	// Serialize the config back to proto to store it in the entity.
  	cfgBlob, err := proto.Marshal(ca)
  	if err != nil {
  		return err
  	}
  
  	// Create or update the entity.
  	return ds.RunInTransaction(c, func(c context.Context) error {
  		existing := CA{CN: ca.Cn}
  		err := ds.Get(c, &existing)
  		if err != nil && err != ds.ErrNoSuchEntity {
  			return err
  		}
  		// New one?
  		if err == ds.ErrNoSuchEntity {
  			logging.Infof(c, "Adding new CA %q", ca.Cn)
  			return ds.Put(c, &CA{
  				CN:         ca.Cn,
  				Config:     cfgBlob,
  				Cert:       certDer,
  				AddedRev:   rev,
  				UpdatedRev: rev,
  			})
  		}
  		// Exists already? Check whether we should update it.
  		if !existing.Removed &&
  			bytes.Equal(existing.Config, cfgBlob) &&
  			bytes.Equal(existing.Cert, certDer) {
  			return nil
  		}
  		logging.Infof(c, "Updating CA %q", ca.Cn)
  		existing.Config = cfgBlob
  		existing.Cert = certDer
  		existing.Removed = false
  		existing.UpdatedRev = rev
  		existing.RemovedRev = ""
  		return ds.Put(c, &existing)
  	}, nil)
  }
docs: // importCA imports CA definition from the config (or updates an existing one).