code: func (s *SecurityConfig) updateTLSCredentials(certificate *tls.Certificate, issuerInfo *IssuerInfo) error {
  	certs := []tls.Certificate{*certificate}
  	clientConfig, err := NewClientTLSConfig(certs, s.rootCA.Pool, ManagerRole)
  	if err != nil {
  		return errors.Wrap(err, "failed to create a new client config using the new root CA")
  	}
  
  	serverConfig, err := NewServerTLSConfig(certs, s.rootCA.Pool)
  	if err != nil {
  		return errors.Wrap(err, "failed to create a new server config using the new root CA")
  	}
  
  	if err := s.ClientTLSCreds.loadNewTLSConfig(clientConfig); err != nil {
  		return errors.Wrap(err, "failed to update the client credentials")
  	}
  
  	if err := s.ServerTLSCreds.loadNewTLSConfig(serverConfig); err != nil {
  		return errors.Wrap(err, "failed to update the server TLS credentials")
  	}
  
  	s.certificate = certificate
  	s.issuerInfo = issuerInfo
  	if s.queue != nil {
  		s.queue.Publish(&api.NodeTLSInfo{
  			TrustRoot:           s.rootCA.Certs,
  			CertIssuerPublicKey: s.issuerInfo.PublicKey,
  			CertIssuerSubject:   s.issuerInfo.Subject,
  		})
  	}
  	return nil
  }
docs: // This function expects something else to have taken out a lock on the SecurityConfig.