Consul Connect: Explain how to generate a custom certificate

#### Overview

This is a documentation enhancement request. [This page](https://www.consul.io/docs/connect/ca/consul) says:

```
Consul ships with a built-in CA system so that Connect can be easily enabled out of the box. The built-in CA generates and stores the root certificate and private key on Consul servers. It can also be configured with a custom certificate and private key if needed.
```

That's what I'm trying to achieve: providing a custom certificate to Consul Connect. The [same page says below](https://www.consul.io/docs/connect/ca/consul#specifying-a-custom-private-key-and-root-certificate):

```
Currently consul requires that root certificates are valid SPIFFE SVID Signing certificates and that the URI encoded in the SAN is the cluster identifier created at bootstrap with the ".consul" TLD. In this example, we will set the URI SAN to spiffe://36cb52cd-4058-f811-0432-6798a240c5d3.consul.
```

#### Request

I have two questions/blockers. If you can add this info to the documentation, I'm sure it will be very useful for others:

1. How can I get the `cluster identifier created at bootstrap`? I have reviewed the Consul's API and I can't find an endpoint to get that information. I have reviewed the Consul's logs and I can't find it either. Where can I find this uuid?

2. Maybe this is out of the scope of the Consul's documentation but, can you at least provide a link to a page that explains how to generate a SPIFFE certificate?

Thank you very much in advance!

Start with the Consul Connect CA documentation and its “Specifying a custom private key and root certificate” section, then trace how the bootstrap cluster identifier and SPIFFE SVID signing requirements are described elsewhere in the Consul documentation. Done means the page explains how to find the cluster identifier and links to reliable instructions for generating a compatible SPIFFE certificate.

Written by the indexing model from the issue text.