code: func (rca *RootCA) CrossSignCACertificate(otherCAPEM []byte) ([]byte, error) {
  	signer, err := rca.Signer()
  	if err != nil {
  		return nil, err
  	}
  
  	// create a new cert with exactly the same parameters, including the public key and exact NotBefore and NotAfter
  	template, err := helpers.ParseCertificatePEM(otherCAPEM)
  	if err != nil {
  		return nil, errors.New("could not parse new CA certificate")
  	}
  
  	if !template.IsCA {
  		return nil, errors.New("certificate not a CA")
  	}
  
  	template.SignatureAlgorithm = signer.parsedCert.SignatureAlgorithm // make sure we can sign with the signer key
  	derBytes, err := x509.CreateCertificate(cryptorand.Reader, template, signer.parsedCert, template.PublicKey, signer.cryptoSigner)
  	if err != nil {
  		return nil, errors.Wrap(err, "could not cross-sign new CA certificate using old CA material")
  	}
  
  	return pem.EncodeToMemory(&pem.Block{
  		Type:  "CERTIFICATE",
  		Bytes: derBytes,
  	}), nil
  }
docs: // CrossSignCACertificate takes a CA root certificate and generates an intermediate CA from it signed with the current root signer