code: func NewSelfSignedCACert(cfg Config, key crypto.Signer) (*x509.Certificate, error) {
  	now := time.Now()
  	tmpl := x509.Certificate{
  		SerialNumber: new(big.Int).SetInt64(0),
  		Subject: pkix.Name{
  			CommonName:   cfg.CommonName,
  			Organization: cfg.Organization,
  		},
  		NotBefore:             now.UTC(),
  		NotAfter:              now.Add(duration365d * 10).UTC(),
  		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
  		BasicConstraintsValid: true,
  		IsCA:                  true,
  	}
  
  	certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &tmpl, &tmpl, key.Public(), key)
  	if err != nil {
  		return nil, err
  	}
  	return x509.ParseCertificate(certDERBytes)
  }
docs: // NewSelfSignedCACert creates a CA certificate