code: func NewExternalCA(intermediates []byte, tlsConfig *tls.Config, urls ...string) *ExternalCA {
  	return &ExternalCA{
  		ExternalRequestTimeout: 5 * time.Second,
  		intermediates:          intermediates,
  		urls:                   urls,
  		client: &http.Client{
  			Transport: &http.Transport{
  				TLSClientConfig: tlsConfig,
  			},
  		},
  	}
  }
docs: // NewExternalCA creates a new ExternalCA which uses the given tlsConfig to
  // authenticate to any of the given URLS of CFSSL API endpoints.