You are an expert in writing code in many different languages. Your goal is to perform code completion for the following code, keeping in mind the rest of the code and the file meta data.
    Metadata details:
    filename: cert.go
    path of file: ./repos/kuma/pkg/tls
    
    the code of the file until where you have to start completion: package tls

import (
	"crypto"
	"crypto/ecdsa"
	"crypto/elliptic"
	"crypto/rand"
	"crypto/x509"
	"crypto/x509/pkix"
	"math/big"
	"net"
	"time"

	"github.com/pkg/errors"

	"github.com/kumahq/kuma/pkg/core"
	util_rsa "github.com/kumahq/kuma/pkg/util/rsa"
)

var DefaultValidityPeriod = 10 * 365 * 24 * time.Hour

type CertType string

const (
	ServerCertType              CertType = "server"
	ClientCertType              CertType = "client"
	DefaultAllowedClockSkew              = 5 * time.Minute
	DefaultCACertValidityPeriod          = 10 * 365 * 24 * time.Hour
)

type KeyType func() (crypto.Signer, error)

var ECDSAKeyType KeyType = func() (crypto.Signer, error) {
	return ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
}

var RSAKeyType KeyType = func() (crypto.Signer, error) {
	return util_rsa.GenerateKey(util_rsa.DefaultKeySize)
}

var DefaultKeyType = RSAKeyType

func NewSelfSignedCert(certType CertType, keyType KeyType, hosts ...string) (KeyPair, error) {
	key, err := keyType()
	if err != nil {
		return KeyPair{}, errors.Wrap(err, "failed to generate TLS key")
	}


    
func newCert(issuer *pkix.Name, certType CertType, hosts ...string) (x509.Certificate, error) {
	notBefore := time.Now()
	notAfter := notBefore.Add(DefaultValidityPeriod)
	serialNumberLimit := new(big.Int).Lsh(big.NewInt(1), 128)
	serialNumber, err := rand.Int(rand.Reader, serialNumberLimit)
	if err != nil {
		return x509.Certificate{}, errors.Wrap(err, "failed to generate serial number")
	}
	csr := x509.Certificate{
		SerialNumber:          serialNumber,
		Subject:               pkix.Name{},
		NotBefore:             notBefore,
		NotAfter:              notAfter,
		IsCA:                  issuer == nil,
		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
		ExtKeyUsage:           []x509.ExtKeyUsage{},
		BasicConstraintsValid: true,
	}
	if issuer != nil {
		csr.Issuer = *issuer
	} else {
		csr.KeyUsage |= x509.KeyUsageCertSign
	}
	switch certType {
	case ServerCertType:
		csr.ExtKeyUsage = append(csr.ExtKeyUsage, x509.ExtKeyUsageServerAuth)
	case ClientCertType:
		csr.ExtKeyUsage = append(csr.ExtKeyUsage, x509.ExtKeyUsageClientAuth)
	default:
		return x509.Certificate{}, errors.Errorf("invalid certificate type %q, expected either %q or %q",
			certType, ServerCertType, ClientCertType)
	}
	for _, host := range hosts {
		if ip := net.ParseIP(host); ip != nil {
			csr.IPAddresses = append(csr.IPAddresses, ip)
		} else {
			csr.DNSNames = append(csr.DNSNames, host)
		}
	}
	return csr, nil
}