certPem       []byte
	keyPem        []byte
	KeyCertBundle *util.KeyCertBundle
	certLifetime  time.Duration

	rejectCSR       bool
	emptyCert       bool
	faultInjectLock *sync.Mutex
}

func NewCAServerWithKeyCert(port int, key, cert []byte, opts ...grpc.ServerOption) (*CAServer, error) {
	keyCertBundle, err := util.NewVerifiedKeyCertBundleFromPem(cert, key, nil, cert)
	if err != nil {