code: func generateCerts(tmpDir string, rootCA *ca.RootCA, nodeID, role, org string, writeKey bool) error {
  	signer, err := rootCA.Signer()
  	if err != nil {
  		return err
  	}
  	certDir := filepath.Join(tmpDir, "certificates")
  	if err := os.MkdirAll(certDir, 0700); err != nil {
  		return err
  	}
  	certPaths := ca.NewConfigPaths(certDir)
  	if err := ioutil.WriteFile(certPaths.RootCA.Cert, signer.Cert, 0644); err != nil {
  		return err
  	}
  	if writeKey {
  		if err := ioutil.WriteFile(certPaths.RootCA.Key, signer.Key, 0600); err != nil {
  			return err
  		}
  	}
  	_, _, err = rootCA.IssueAndSaveNewCertificates(
  		ca.NewKeyReadWriter(certPaths.Node, nil, nil), nodeID, role, org)
  	return err
  }
docs: // generateCerts generates/overwrites TLS certificates for a node in a particular directory