code: func (c *ConsulProvider) GenerateRoot() error {
  	idx, providerState, err := c.getState()
  	if err != nil {
  		return err
  	}
  
  	if !c.isRoot {
  		return fmt.Errorf("provider is not the root certificate authority")
  	}
  	if providerState.RootCert != "" {
  		return nil
  	}
  
  	// Generate a private key if needed
  	newState := *providerState
  	if c.config.PrivateKey == "" {
  		_, pk, err := connect.GeneratePrivateKey()
  		if err != nil {
  			return err
  		}
  		newState.PrivateKey = pk
  	} else {
  		newState.PrivateKey = c.config.PrivateKey
  	}
  
  	// Generate the root CA if necessary
  	if c.config.RootCert == "" {
  		ca, err := c.generateCA(newState.PrivateKey, idx+1)
  		if err != nil {
  			return fmt.Errorf("error generating CA: %v", err)
  		}
  		newState.RootCert = ca
  	} else {
  		newState.RootCert = c.config.RootCert
  	}
  
  	// Write the provider state
  	args := &structs.CARequest{
  		Op:            structs.CAOpSetProviderState,
  		ProviderState: &newState,
  	}
  	if err := c.Delegate.ApplyCARequest(args); err != nil {
  		return err
  	}
  
  	return nil
  }
docs: // GenerateRoot initializes a new root certificate and private key
  // if needed.