code: func (v *VaultProvider) CrossSignCA(cert *x509.Certificate) (string, error) {
  	var pemBuf bytes.Buffer
  	err := pem.Encode(&pemBuf, &pem.Block{Type: "CERTIFICATE", Bytes: cert.Raw})
  	if err != nil {
  		return "", err
  	}
  
  	// Have the root PKI backend sign this cert.
  	response, err := v.client.Logical().Write(v.config.RootPKIPath+"root/sign-self-issued", map[string]interface{}{
  		"certificate": pemBuf.String(),
  	})
  	if err != nil {
  		return "", fmt.Errorf("error having Vault cross-sign cert: %v", err)
  	}
  	if response == nil || response.Data["certificate"] == "" {
  		return "", fmt.Errorf("certificate info returned from Vault was blank")
  	}
  
  	xcCert, ok := response.Data["certificate"].(string)
  	if !ok {
  		return "", fmt.Errorf("certificate was not a string")
  	}
  
  	return xcCert, nil
  }
docs: // CrossSignCA takes a CA certificate and cross-signs it to form a trust chain
  // back to our active root.