}

	hosts := strings.SplitSeq(host, ",")
	for h := range hosts {
		if ip := net.ParseIP(h); ip != nil {
			template.IPAddresses = append(template.IPAddresses, ip)
		} else {
			template.DNSNames = append(template.DNSNames, h)
		}
	}

	template.IsCA = true
	template.KeyUsage |= x509.KeyUsageCertSign

	derBytes, err := x509.CreateCertificate(crand.Reader, &template, &template, publicKey(priv), priv)

	if globalIsTLS {
		for _, c := range globalPublicCerts {
			check := xxh3.Hash(c.RawIssuer)
			check ^= xxh3.Hash(c.RawSubjectPublicKeyInfo)
			// We XOR, so order doesn't matter.
			for _, v := range c.DNSNames {
				check ^= xxh3.HashString(v)
			}
			for _, v := range c.EmailAddresses {
				check ^= xxh3.HashString(v)
			}
			for _, v := range c.IPAddresses {
				check ^= xxh3.HashString(v.String())

pkg crypto/x509, type CertificateRequest struct
pkg crypto/x509, type CertificateRequest struct, Attributes []pkix.AttributeTypeAndValueSET
pkg crypto/x509, type CertificateRequest struct, DNSNames []string
pkg crypto/x509, type CertificateRequest struct, EmailAddresses []string
pkg crypto/x509, type CertificateRequest struct, Extensions []pkix.Extension

pkg crypto/x509, type Certificate struct
pkg crypto/x509, type Certificate struct, AuthorityKeyId []uint8
pkg crypto/x509, type Certificate struct, BasicConstraintsValid bool
pkg crypto/x509, type Certificate struct, DNSNames []string
pkg crypto/x509, type Certificate struct, EmailAddresses []string
pkg crypto/x509, type Certificate struct, ExtKeyUsage []ExtKeyUsage
pkg crypto/x509, type Certificate struct, IsCA bool