code: func RenewTLSConfigNow(ctx context.Context, s *SecurityConfig, connBroker *connectionbroker.Broker, rootPaths CertPaths) error {
  	s.renewalMu.Lock()
  	defer s.renewalMu.Unlock()
  
  	ctx = log.WithModule(ctx, "tls")
  	log := log.G(ctx).WithFields(logrus.Fields{
  		"node.id":   s.ClientTLSCreds.NodeID(),
  		"node.role": s.ClientTLSCreds.Role(),
  	})
  
  	// Let's request new certs. Renewals don't require a token.
  	rootCA := s.RootCA()
  	tlsKeyPair, issuerInfo, err := rootCA.RequestAndSaveNewCertificates(ctx,
  		s.KeyWriter(),
  		CertificateRequestConfig{
  			ConnBroker:  connBroker,
  			Credentials: s.ClientTLSCreds,
  		})
  	if wrappedError, ok := err.(x509UnknownAuthError); ok {
  		var newErr error
  		tlsKeyPair, issuerInfo, newErr = updateRootThenUpdateCert(ctx, s, connBroker, rootPaths, wrappedError.failedLeafCert)
  		if newErr != nil {
  			err = wrappedError.error
  		} else {
  			err = nil
  		}
  	}
  	if err != nil {
  		log.WithError(err).Errorf("failed to renew the certificate")
  		return err
  	}
  
  	return s.UpdateTLSCredentials(tlsKeyPair, issuerInfo)
  }
docs: // RenewTLSConfigNow gets a new TLS cert and key, and updates the security config if provided.  This is similar to
  // RenewTLSConfig, except while that monitors for expiry, and periodically renews, this renews once and is blocking