Currently, the only way to bootstrap a swarm with external CAs is to put the CA certificate in /var/lib/docker/swarm/certificates/swarm-root-ca.crt, and to pre-generate a cert and key for that node and put it in, respectively, /var/lib/docker/swarm/certificates/swarm-node.crt and /var/lib/docker/swarm/certificates/swarm-node.key before running docker swarm init --external-ca ....

However, this seems like a very unfriendly way to set up external CAs - it'd be better for the CA cert to be passed explicitly.

Since --ca-cert and --ca-key can already be passed to swarm when rotating the CA, it makes sense to also accept both when initializing a swarm for the first time.

See #33216 for the original discussion.

Also, moby/swarmkit#2189.