opts.Org = orgs[0]
	}
	// TODO(JimmyCYJ): parse other fields from certificate, e.g. CommonName.
	return opts, nil
}

// MergeCertOptions merges deltaOpts into defaultOpts and returns the merged
// CertOptions. Only called by a self-signed Citadel.
func MergeCertOptions(defaultOpts, deltaOpts CertOptions) CertOptions {
	if len(deltaOpts.Org) > 0 {
		defaultOpts.Org = deltaOpts.Org
	}

	// This is to make sure when rotate the root cert, we don't make unnecessary changes
	// to the certificate or add extra fields to the certificate.
	options = util.MergeCertOptions(options, oldCertOptions)
	pemCert, pemKey, ckErr := util.GenRootCertFromExistingKey(options)
	if ckErr != nil {
		rootCertRotatorLog.Errorf("unable to generate CA cert and key for self-signed CA: %s", ckErr.Error())

		Org:           defaultOrg,
		IsCA:          true,
		IsSelfSigned:  true,
		RSAKeySize:    defaultRSAKeySize,
		IsDualUse:     false,
	}
	// Merge cert options.
	newCertOptions = MergeCertOptions(newCertOptions, oldCertOptions)
	if newCertOptions.Org != oldOrg && newCertOptions.Org == defaultOrg {
		t.Error("Org in cert options should be overwritten")
	}
	// 3. create new root certificate.