docs: def _sign(self, certificate_request, password):
          """
          Respond to a request to sign a CSR for a user or agent located within
          our domain.
          """
          if self.service.portal is None:
              raise BadCertificateRequest("This agent cannot sign certificates.")
  
          subj = certificate_request.getSubject()
  
          sk = subj.keys()
          if 'commonName' not in sk:
              raise BadCertificateRequest(
                  "Certificate requested with bad subject: %s" % (sk,))
  
          uandd = subj.commonName.split("@")
          if len(uandd) != 2:
              raise BadCertificateRequest(
                  "Won't sign certificates for other domains"
              )
          domain = uandd[1]
  
          CS = self.service.certificateStorage
          ourCert = CS.getPrivateCertificate(domain)
  
          D = self.service.portal.login(
              UsernameShadowPassword(subj.commonName, password),
              self,
              ivertex.IQ2QUser)
  
          def _(ial):
              (iface, aspect, logout) = ial
              ser = CS.genSerial(domain)
              return dict(certificate=aspect.signCertificateRequest(
                      certificate_request, ourCert, ser))
  
          return D.addCallback(_)