code: func parseExternalCA(caSpec string) (*api.ExternalCA, error) {
  	csvReader := csv.NewReader(strings.NewReader(caSpec))
  	fields, err := csvReader.Read()
  	if err != nil {
  		return nil, err
  	}
  
  	externalCA := api.ExternalCA{
  		Options: make(map[string]string),
  	}
  
  	var (
  		hasProtocol bool
  		hasURL      bool
  	)
  
  	for _, field := range fields {
  		parts := strings.SplitN(field, "=", 2)
  
  		if len(parts) != 2 {
  			return nil, fmt.Errorf("invalid field '%s' must be a key=value pair", field)
  		}
  
  		key, value := parts[0], parts[1]
  
  		switch strings.ToLower(key) {
  		case "protocol":
  			hasProtocol = true
  			if strings.ToLower(value) == "cfssl" {
  				externalCA.Protocol = api.ExternalCA_CAProtocolCFSSL
  			} else {
  				return nil, fmt.Errorf("unrecognized external CA protocol %s", value)
  			}
  		case "url":
  			hasURL = true
  			externalCA.URL = value
  		default:
  			externalCA.Options[key] = value
  		}
  	}
  
  	if !hasProtocol {
  		return nil, errors.New("the external-ca option needs a protocol= parameter")
  	}
  	if !hasURL {
  		return nil, errors.New("the external-ca option needs a url= parameter")
  	}
  
  	return &externalCA, nil
  }
docs: // parseExternalCA parses an external CA specification from the command line,
  // such as protocol=cfssl,url=https://example.com.