code: func (s *SecurityConfig) UpdateRootCA(rootCA *RootCA) error {
  	s.mu.Lock()
  	defer s.mu.Unlock()
  
  	// refuse to update the root CA if the current TLS credentials do not validate against it
  	if err := validateRootCAAndTLSCert(rootCA, s.certificate); err != nil {
  		return err
  	}
  
  	s.rootCA = rootCA
  	return s.updateTLSCredentials(s.certificate, s.issuerInfo)
  }
docs: // UpdateRootCA replaces the root CA with a new root CA