maxCertTTL, org, false, false, caNamespace, client.CoreV1(),
		rootCertFile, false, rsaKeySize)
	if err != nil {
		t.Fatalf("Failed to create a self-signed CA Options: %v", err)
	}

	ca, err := NewIstioCA(caopts)
	if err != nil {
		t.Errorf("Got error while creating self-signed CA: %v", err)
	}
	if ca == nil {
		t.Fatalf("Failed to create a self-signed CA.")
	}

	f.Fuzz(func(t *testing.T, data, csrPEM []byte) {
		ff := fuzz.NewConsumer(data)
		// create ca options
		opts := &IstioCAOptions{}
		err := ff.GenerateStruct(opts)
		if err != nil {
			return
		}
		ca, err := NewIstioCA(opts)
		if err != nil {
			return
		}

		// create cert options
		certOpts := CertOpts{}
		err = ff.GenerateStruct(&certOpts)
		if err != nil {
			return
		}
		TTL, err := time.ParseDuration("800ms")

	// rootCertRotator periodically rotates self-signed root cert for CA. It is nil
	// if CA is not self-signed CA.
	rootCertRotator *SelfSignedCARootCertRotator
}

// NewIstioCA returns a new IstioCA instance.
func NewIstioCA(opts *IstioCAOptions) (*IstioCA, error) {
	ca := &IstioCA{
		maxCertTTL:    opts.MaxCertTTL,
		keyCertBundle: opts.KeyCertBundle,
		caRSAKeySize:  opts.CARSAKeySize,
	}

		caNamespace, client, rootCertFile, false, rsaKeySize)
	return caopts
}

func getRootCertRotator(opts *IstioCAOptions) *SelfSignedCARootCertRotator {
	ca, _ := NewIstioCA(opts)
	ca.rootCertRotator.config.retryMax = time.Millisecond * 50
	ca.rootCertRotator.config.retryInterval = time.Millisecond * 5
	return ca.rootCertRotator

		if err != nil {
			return nil, fmt.Errorf("failed to create an istiod CA: %v", err)
		}

		s.initCACertsWatcher()
	}
	istioCA, err := ca.NewIstioCA(caOpts)
	if err != nil {
		return nil, fmt.Errorf("failed to create an istiod CA: %v", err)
	}

	// Start root cert rotator in a separate goroutine.
	istioCA.Run(s.internalStop)
	return istioCA, nil
}