t.Error("cert is not signed by signing CA as expected")
	}
}

// AssertCertificateHasNotBefore is a utility function for kubeadm testing that asserts if a given certificate has
// the expected NotBefore. Truncate (round) expectedNotBefore to 1 second, since the certificate stores
// with seconds as the maximum precision.
func AssertCertificateHasNotBefore(t *testing.T, cert *x509.Certificate, expectedNotBefore time.Time) {

			certtestutil.AssertCertificateHasDNSNames(t, newCert, testCertCfg.AltNames.DNSNames...)
			certtestutil.AssertCertificateHasIPAddresses(t, newCert, testCertCfg.AltNames.IPs...)
			certtestutil.AssertCertificateHasNotBefore(t, newCert, testCertCfg.NotBefore)
			certtestutil.AssertCertificateHasNotAfter(t, newCert, testCertCfg.NotAfter)
		})
	}
}

func TestCreateRenewCSR(t *testing.T) {
	dir := testutil.SetupTempDir(t)