func TestGenCertKeyFromOptions(t *testing.T) {
	// set "notBefore" to be one hour ago, this ensures the issued certificate to
	// be valid as of now.
	caCertNotBefore := now.Add(-time.Hour)
	caCertTTL := 24 * time.Hour
	host := "test_ca.com"

	// Options to generate a CA cert with RSA.
	rsaCaCertOptions := CertOptions{
		Host:         host,
		NotBefore:    caCertNotBefore,
		TTL:          caCertTTL,
		SignerCert:   nil,
		SignerPriv:   nil,

	MLA_S_CS
	MLA_S_CC
	MLA_S_MI
	MLA_S_PL
	MLA_S_VS
	MLA_S_VC
	MLA_S_HI
	MLA_S_LS
	MLA_S_GE
	MLA_S_LT
	MLA_S_GT
	MLA_S_LE
	MLA_S
	MLA_S_ZZ
	MLS_EQ
	MLS_NE
	MLS_CS
	MLS_CC
	MLS_MI
	MLS_PL
	MLS_VS
	MLS_VC
	MLS_HI
	MLS_LS
	MLS_GE
	MLS_LT
	MLS_GT
	MLS_LE
	MLS
	MLS_ZZ
	MOV_EQ
	MOV_NE
	MOV_CS
	MOV_CC
	MOV_MI
	MOV_PL

	MOVD	_cgo_init(SB), R12
	CBZ	R12, nocgo

#ifdef GOOS_android
	MRS_TPIDR_R0			// load TLS base pointer
	MOVD	R0, R3			// arg 3: TLS base pointer
	MOVD	$runtime·tls_g(SB), R2 	// arg 2: &tls_g
#else
	MOVD	$0, R2		        // arg 2: not used when using platform's TLS
#endif
	MOVD	$setg_gcc<>(SB), R1	// arg 1: setg
	MOVD	g, R0			// arg 0: G
	SUB	$16, RSP		// reserve 16 bytes for sp-8 where fp may be saved.

		return t.DialTLSContext(ctx, network, addr, tlsCfg)
	} else if t.DialTLS != nil {
		return t.DialTLS(network, addr, tlsCfg)
	}

	tlsCn, err := t.dialTLSWithContext(ctx, network, addr, tlsCfg)
	if err != nil {
		return nil, err
	}
	state := tlsCn.ConnectionState()
	if p := state.NegotiatedProtocol; p != http2NextProtoTLS {

    HTTPS certificates issued to certain IPv6 addresses.
 *  Fix: Don't reuse connections after an unsuccessful `Expect: 100-continue`.
 *  Fix: Handle either `TLS_` or `SSL_` prefixes for cipher suite names. This is necessary for
    IBM JVMs that use the `SSL_` prefix exclusively.
 *  Fix: Reject HTTP/2 data frames if the stream ID is 0.
 *  New: Upgrade to Okio 1.12.0.