code: func validateCACert(l certKeyLocation) error {
  	// Check CA Cert
  	caCert, err := pkiutil.TryLoadCertFromDisk(l.pkiDir, l.caBaseName)
  	if err != nil {
  		return errors.Wrapf(err, "failure loading certificate for %s", l.uxName)
  	}
  
  	// Check if cert is a CA
  	if !caCert.IsCA {
  		return errors.Errorf("certificate %s is not a CA", l.uxName)
  	}
  	return nil
  }
docs: // validateCACert tries to load a x509 certificate from pkiDir and validates that it is a CA