code: func (xcg *X509CertGenerator) GenerateCACertificate(certFile, keyFile, org string, bits int) error {
  	template, err := xcg.newCertificate(org)
  	if err != nil {
  		return err
  	}
  
  	template.IsCA = true
  	template.KeyUsage |= x509.KeyUsageCertSign
  	template.KeyUsage |= x509.KeyUsageKeyEncipherment
  	template.KeyUsage |= x509.KeyUsageKeyAgreement
  
  	priv, err := rsa.GenerateKey(rand.Reader, bits)
  	if err != nil {
  		return err
  	}
  
  	derBytes, err := x509.CreateCertificate(rand.Reader, template, template, &priv.PublicKey, priv)
  	if err != nil {
  		return err
  	}
  
  	certOut, err := os.Create(certFile)
  	if err != nil {
  		return err
  	}
  
  	pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
  	certOut.Close()
  
  	keyOut, err := os.OpenFile(keyFile, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600)
  	if err != nil {
  		return err
  
  	}
  
  	pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
  	keyOut.Close()
  
  	return nil
  }
docs: // GenerateCACertificate generates a new certificate authority from the specified org
  // and bit size and stores the resulting certificate and key file
  // in the arguments.