backOffTime        time.Duration
	ca                 *IstioCA
	onRootCertUpdate   func() error
}

// NewSelfSignedCARootCertRotator returns a new root cert rotator instance that
// rotates self-signed root cert periodically.
// nolint: gosec
// Not security sensitive code
func NewSelfSignedCARootCertRotator(config *SelfSignedCARootCertRotatorConfig,
	ca *IstioCA,
	onRootCertUpdate func() error,
) *SelfSignedCARootCertRotator {

	KeyCertBundle *util.KeyCertBundle

	// Config for creating self-signed root cert rotator.
	RotatorConfig *SelfSignedCARootCertRotatorConfig

	// OnRootCertUpdate is the cb which can only be called by self-signed root cert rotator
	OnRootCertUpdate func() error
}

type RootCertUpdateFunc func() error

// NewSelfSignedIstioCAOptions returns a new IstioCAOptions instance using self-signed certificate.

		// or it is `cacerts` secret mounted with "istio-generated" key set.
		caOpts, err = s.createSelfSignedCACertificateOptions(&fileBundle, opts)
		if err != nil {
			return nil, err
		}
		caOpts.OnRootCertUpdate = s.updateRootCertAndGenKeyCert
	} else {
		// The secret is mounted and the "istio-generated" key is not used.
		log.Info("Use local CA certificate")