code: func NewSecurityConfig(rootCA *RootCA, krw *KeyReadWriter, tlsKeyPair *tls.Certificate, issuerInfo *IssuerInfo) (*SecurityConfig, func() error, error) {
  	// Create the Server TLS Credentials for this node. These will not be used by workers.
  	serverTLSCreds, err := rootCA.NewServerTLSCredentials(tlsKeyPair)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	// Create a TLSConfig to be used when this node connects as a client to another remote node.
  	// We're using ManagerRole as remote serverName for TLS host verification because both workers
  	// and managers always connect to remote managers.
  	clientTLSCreds, err := rootCA.NewClientTLSCredentials(tlsKeyPair, ManagerRole)
  	if err != nil {
  		return nil, nil, err
  	}
  
  	q := watch.NewQueue()
  	return &SecurityConfig{
  		rootCA:        rootCA,
  		keyReadWriter: krw,
  
  		certificate: tlsKeyPair,
  		issuerInfo:  issuerInfo,
  		queue:       q,
  
  		ClientTLSCreds: clientTLSCreds,
  		ServerTLSCreds: serverTLSCreds,
  	}, q.Close, nil
  }
docs: // NewSecurityConfig initializes and returns a new SecurityConfig.