type ErrType int

const (
	// CANotReady means the CA is not ready to sign CSRs.
	CANotReady ErrType = iota
	// CSRError means the CA cannot sign CSR due to CSR error.
	CSRError
	// TTLError means the required TTL is invalid.
	TTLError
	// CertGenError means an error happened during the certificate generation.
	CertGenError
	// CAIllegalConfig means the configuration/deployment parameters for CA are incorrect
	CAIllegalConfig

			code:    codes.Internal,
		},
		"CSR_ERROR": {
			eType:   CSRError,
			err:     fmt.Errorf("test error2"),
			message: "CSR_ERROR",
			code:    codes.InvalidArgument,
		},
		"TTL_ERROR": {
			eType:   TTLError,
			err:     fmt.Errorf("test error3"),
			message: "TTL_ERROR",
			code:    codes.InvalidArgument,
		},
		"CERT_GEN_ERROR": {
			eType:   CertGenError,
			err:     fmt.Errorf("test error4"),

		lifetime = raOpts.DefaultCertTTL
	}
	// If the requested TTL is greater than maxCertTTL, return an error
	if requestedLifetime.Seconds() > raOpts.MaxCertTTL.Seconds() {
		return lifetime, raerror.NewError(raerror.TTLError, fmt.Errorf(
			"requested TTL %s is greater than the max allowed TTL %s", requestedLifetime, raOpts.MaxCertTTL))
	}
	return lifetime, nil

				mile(fmt.Sprintf("FinishCreate(%v)", success))
			}, nil
		},
		ttl: func(_ runtime.Object, existing uint64, _ bool) (uint64, error) {
			mile("TTLError")
			return existing, fmt.Errorf("TTL fail")
		},
		expectMilestones: []string{"BeginCreate", "TTLError", "FinishCreate(false)"},
		expectError:      true,
	}, {
		name:        "fail BeginCreate ordering",
		expectError: true,

		},
		"Invalid TTL": {
			authenticators: []security.Authenticator{&mockAuthenticator{identities: []string{"test-identity"}}},
			ca:             &mockca.FakeCA{SignErr: caerror.NewError(caerror.TTLError, fmt.Errorf("cannot sign"))},
			code:           codes.InvalidArgument,
		},
		"Failed to sign": {
			authenticators: []security.Authenticator{&mockAuthenticator{identities: []string{"test-identity"}}},

	}
	// If checkLifetime is set and the requested TTL is greater than maxCertTTL, return an error
	if checkLifetime && requestedLifetime.Seconds() > ca.maxCertTTL.Seconds() {
		return nil, caerror.NewError(caerror.TTLError, fmt.Errorf(
			"requested TTL %s is greater than the max allowed TTL %s", requestedLifetime, ca.maxCertTTL))
	}