code: func newCertSubPhases() []workflow.Phase {
  	subPhases := []workflow.Phase{}
  
  	// All subphase
  	allPhase := workflow.Phase{
  		Name:           "all",
  		Short:          "Generate all certificates",
  		InheritFlags:   getCertPhaseFlags("all"),
  		RunAllSiblings: true,
  	}
  
  	subPhases = append(subPhases, allPhase)
  
  	certTree, _ := certsphase.GetDefaultCertList().AsMap().CertTree()
  
  	for ca, certList := range certTree {
  		caPhase := newCertSubPhase(ca, runCAPhase(ca))
  		subPhases = append(subPhases, caPhase)
  
  		for _, cert := range certList {
  			certPhase := newCertSubPhase(cert, runCertPhase(cert, ca))
  			certPhase.LocalFlags = localFlags()
  			subPhases = append(subPhases, certPhase)
  		}
  	}
  
  	// SA creates the private/public key pair, which doesn't use x509 at all
  	saPhase := workflow.Phase{
  		Name:         "sa",
  		Short:        "Generate a private key for signing service account tokens along with its public key",
  		Long:         saKeyLongDesc,
  		Run:          runCertsSa,
  		InheritFlags: []string{options.CertificatesDir},
  	}
  
  	subPhases = append(subPhases, saPhase)
  
  	return subPhases
  }
docs: // newCertSubPhases returns sub phases for certs phase