return pemCert, options.SignerPrivPem, nil
}

// GetCertOptionsFromExistingCert parses cert and generates a CertOptions
// that contains information about the cert. This is the reverse operation of
// genCertTemplateFromOptions(), and only called by a self-signed Citadel.
func GetCertOptionsFromExistingCert(certBytes []byte) (opts CertOptions, err error) {
	cert, certErr := ParsePemEncodedCertificate(certBytes)

				_ = rotator.onRootCertUpdate()
			}
		}
		return
	}

	rootCertRotatorLog.Infof("Refresh root certificate, root cert is about to expire: %s", err.Error())

	oldCertOptions, err := util.GetCertOptionsFromExistingCert(caSecret.Data[CACertFile])
	if err != nil {
		rootCertRotatorLog.Warnf("Failed to generate cert options from existing root certificate (%v), "+
			"new root certificate may not match old root certificate", err)
	}

		t.Errorf("failed to generate root certificate from options: %v", err)
	}

	// Rotate root certificate using the old private key.
	// 1. get cert option from old root certificate.
	oldCertOptions, err := GetCertOptionsFromExistingCert(oldRootCertPem)
	if err != nil {
		t.Errorf("failed to generate cert options from existing root certificate: %v", err)
	}
	// 2. create cert option for new root certificate.
	defaultOrg := "default org"