if err != nil {
		t.Fatalf("Error while generating key: %v", err)
	}

	template := &x509.Certificate{
		SerialNumber: big.NewInt(0),
		Subject: pkix.Name{
			CommonName: cn,
		},
		IsCA:                  true,
		BasicConstraintsValid: true,
	}

	cert, err := x509.CreateCertificate(rand.Reader, template, template, pub, priv)
	if err != nil {
		t.Fatalf("Error while making certificate: %v", err)

	// whether they client has sent exactly one (non-CA) leaf certificate.
	peerCertificates := make([]*x509.Certificate, 0, len(r.TLS.PeerCertificates))
	for _, cert := range r.TLS.PeerCertificates {
		if cert.IsCA {
			continue
		}
		peerCertificates = append(peerCertificates, cert)
	}
	r.TLS.PeerCertificates = peerCertificates

	// Now, we have to check that the client has provided exactly one leaf

	// keyUsage, and a keyUsage containing a flag indicating that the RSA
	// encryption key could only be used for Diffie-Hellman key agreement.

	if certType == intermediateCertificate && (!c.BasicConstraintsValid || !c.IsCA) {
		return CertificateInvalidError{c, NotAuthorizedToSign, ""}
	}

	if c.BasicConstraintsValid && c.MaxPathLen >= 0 {
		numIntermediates := len(currentChain) - 1
		if numIntermediates > c.MaxPathLen {

		if ip := net.ParseIP(h); ip != nil {
			template.IPAddresses = append(template.IPAddresses, ip)
		} else {
			template.DNSNames = append(template.DNSNames, h)
		}
	}

	template.IsCA = true
	template.KeyUsage |= x509.KeyUsageCertSign

	derBytes, err := x509.CreateCertificate(crand.Reader, &template, &template, publicKey(priv), priv)
	if err != nil {

		{"Certificate.ExtKeyUsage", Field, 0},
		{"Certificate.Extensions", Field, 2},
		{"Certificate.ExtraExtensions", Field, 2},
		{"Certificate.IPAddresses", Field, 1},
		{"Certificate.IsCA", Field, 0},
		{"Certificate.Issuer", Field, 0},
		{"Certificate.IssuingCertificateURL", Field, 2},
		{"Certificate.KeyUsage", Field, 0},
		{"Certificate.MaxPathLen", Field, 0},

pkg crypto/x509, type Certificate struct, DNSNames []string
pkg crypto/x509, type Certificate struct, EmailAddresses []string
pkg crypto/x509, type Certificate struct, ExtKeyUsage []ExtKeyUsage
pkg crypto/x509, type Certificate struct, IsCA bool
pkg crypto/x509, type Certificate struct, Issuer pkix.Name
pkg crypto/x509, type Certificate struct, KeyUsage KeyUsage
pkg crypto/x509, type Certificate struct, MaxPathLen int