code: func updateRootThenUpdateCert(ctx context.Context, s *SecurityConfig, connBroker *connectionbroker.Broker, rootPaths CertPaths, failedCert *x509.Certificate) (*tls.Certificate, *IssuerInfo, error) {
  	if len(failedCert.Subject.OrganizationalUnit) == 0 || failedCert.Subject.OrganizationalUnit[0] != WorkerRole {
  		return nil, nil, errors.New("cannot update root CA since this is not a worker")
  	}
  	// try downloading a new root CA if it's an unknown authority issue, in case there was a root rotation completion
  	// and we just didn't get the new root
  	rootCA, err := GetRemoteCA(ctx, "", connBroker)
  	if err != nil {
  		return nil, nil, err
  	}
  	// validate against the existing security config creds
  	if err := s.UpdateRootCA(&rootCA); err != nil {
  		return nil, nil, err
  	}
  	if err := SaveRootCA(rootCA, rootPaths); err != nil {
  		return nil, nil, err
  	}
  	return rootCA.RequestAndSaveNewCertificates(ctx, s.KeyWriter(),
  		CertificateRequestConfig{
  			ConnBroker:  connBroker,
  			Credentials: s.ClientTLSCreds,
  		})
  }
docs: // TODO(cyli): currently we have to only update if it's a worker role - if we have a single root CA update path for
  // both managers and workers, we won't need to check any more.