code: func GenerateSelfSignedCAWithPrivateKey(priv *rsa.PrivateKey, entity pkix.Name, dnsNames []string, ttl time.Duration) ([]byte, []byte, error) {
  	notBefore := time.Now()
  	notAfter := notBefore.Add(ttl)
  
  	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
  	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  	// this is important, otherwise go will accept certificate authorities
  	// signed by the same private key and having the same subject (happens in tests)
  	entity.SerialNumber = serialNumber.String()
  
  	template := x509.Certificate{
  		SerialNumber:          serialNumber,
  		Issuer:                entity,
  		Subject:               entity,
  		NotBefore:             notBefore,
  		NotAfter:              notAfter,
  		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
  		BasicConstraintsValid: true,
  		IsCA:     true,
  		DNSNames: dnsNames,
  	}
  
  	derBytes, err := x509.CreateCertificate(rand.Reader, &template, &template, &priv.PublicKey, priv)
  	if err != nil {
  		return nil, nil, trace.Wrap(err)
  	}
  
  	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
  	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
  
  	return keyPEM, certPEM, nil
  }
docs: // GenerateSelfSignedCA generates self-signed certificate authority used for internal inter-node communications