public static X509Certificate newSelfSignedCACert(X500Name subject, KeyPair keyPair)
    throws IOException, OperatorCreationException, GeneralSecurityException {
    LocalDate now = LocalDate.now(ZoneId.systemDefault());
    X509v3CertificateBuilder builder = initCertBuilder(subject, // for self-signed certs,
      // issuer == subject
      now, now.plusDays(1), subject, keyPair.getPublic());
    builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(true)); // is a CA
    builder.addExtension(Extension.keyUsage, true,
      new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyCertSign | KeyUsage.cRLSign));
    return buildAndSignCertificate(keyPair.getPrivate(), builder);
  }
Uses the private key of the given key pair to create a self-signed CA certificate with the
public half of the key pair and the given subject and expiration. The issuer of the new cert
will be equal to the subject. Returns the new certificate. The returned certificate should be
used as the trust store. The private key of the input key pair should be used to sign
certificates that are used by test peers to establish TLS connections to each other.
@param subject the subject of the new certificate being created.
@param keyPair the key pair to use. The public key will be embedded in the new certificate, and
               the private key will be used to self-sign the certificate.
@return a new self-signed CA certificate.
hbase-common/src/test/java/org/apache/hadoop/hbase/io/crypto/tls/X509TestHelpers.java