code: func NewSignedCert(cfg *certutil.Config, key crypto.Signer, caCert *x509.Certificate, caKey crypto.Signer) (*x509.Certificate, error) {
  	serial, err := rand.Int(rand.Reader, new(big.Int).SetInt64(math.MaxInt64))
  	if err != nil {
  		return nil, err
  	}
  	if len(cfg.CommonName) == 0 {
  		return nil, errors.New("must specify a CommonName")
  	}
  	if len(cfg.Usages) == 0 {
  		return nil, errors.New("must specify at least one ExtKeyUsage")
  	}
  
  	certTmpl := x509.Certificate{
  		Subject: pkix.Name{
  			CommonName:   cfg.CommonName,
  			Organization: cfg.Organization,
  		},
  		DNSNames:     cfg.AltNames.DNSNames,
  		IPAddresses:  cfg.AltNames.IPs,
  		SerialNumber: serial,
  		NotBefore:    caCert.NotBefore,
  		NotAfter:     time.Now().Add(duration365d).UTC(),
  		KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
  		ExtKeyUsage:  cfg.Usages,
  	}
  	certDERBytes, err := x509.CreateCertificate(cryptorand.Reader, &certTmpl, caCert, key.Public(), caKey)
  	if err != nil {
  		return nil, err
  	}
  	return x509.ParseCertificate(certDERBytes)
  }
docs: // NewSignedCert creates a signed certificate using the given CA certificate and key