code: func (rca *RootCA) IssueAndSaveNewCertificates(kw KeyWriter, cn, ou, org string) (*tls.Certificate, *IssuerInfo, error) {
  	csr, key, err := GenerateNewCSR()
  	if err != nil {
  		return nil, nil, errors.Wrap(err, "error when generating new node certs")
  	}
  
  	// Obtain a signed Certificate
  	certChain, err := rca.ParseValidateAndSignCSR(csr, cn, ou, org)
  	if err != nil {
  		return nil, nil, errors.Wrap(err, "failed to sign node certificate")
  	}
  	signer, err := rca.Signer()
  	if err != nil { // should never happen, since if ParseValidateAndSignCSR did not fail this root CA must have a signer
  		return nil, nil, err
  	}
  
  	// Create a valid TLSKeyPair out of the PEM encoded private key and certificate
  	tlsKeyPair, err := tls.X509KeyPair(certChain, key)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	if err := kw.Write(NormalizePEMs(certChain), key, nil); err != nil {
  		return nil, nil, err
  	}
  
  	return &tlsKeyPair, &IssuerInfo{
  		PublicKey: signer.parsedCert.RawSubjectPublicKeyInfo,
  		Subject:   signer.parsedCert.RawSubject,
  	}, nil
  }
docs: // IssueAndSaveNewCertificates generates a new key-pair, signs it with the local root-ca, and returns a
  // TLS certificate and the issuer information for the certificate.