Function generate_cluster_ca 

pub fn generate_cluster_ca(
    cn: &str,
    validity_days: u32,
) -> Result<CaMaterial, CaError>

Generate a self-signed cluster CA.

The shape is the same as generate_clients_ca: ECDSA P-256, CA:TRUE, and KU keyCertSign + cRLSign. The subject DN carries OU=cluster, so a reader can tell the cluster CA and the clients CA apart in cert chains and audit logs.

Errors

Returns an error when credentials or key material are invalid, cryptographic verification fails, or the TLS, SASL, or Kerberos exchange is rejected.