backOffTime        time.Duration
	ca                 *IstioCA
	onRootCertUpdate   func() error
}

// NewSelfSignedCARootCertRotator returns a new root cert rotator instance that
// rotates self-signed root cert periodically.
// nolint: gosec
// Not security sensitive code
func NewSelfSignedCARootCertRotator(config *SelfSignedCARootCertRotatorConfig,
	ca *IstioCA,
	onRootCertUpdate func() error,
) *SelfSignedCARootCertRotator {

		caRSAKeySize:  opts.CARSAKeySize,
	}

	if opts.CAType == selfSignedCA && opts.RotatorConfig != nil && opts.RotatorConfig.CheckInterval > time.Duration(0) {
		ca.rootCertRotator = NewSelfSignedCARootCertRotator(opts.RotatorConfig, ca, opts.OnRootCertUpdate)
	}

	// if CA cert becomes invalid before workload cert it's going to cause workload cert to be invalid too,