code: public X509Certificate signCertificateRequest(PrivateKey caPrivateKey, X509Certificate caCertificate,
              PKCS10CertificationRequest request, BigInteger serialNumber, long lifetime) {
          try {
              logger.entry();
  
              logger.debug("Extract public key and subject from the CSR...");
              PublicKey publicKey = new JcaPEMKeyConverter().getPublicKey(request.getSubjectPublicKeyInfo());
              String subject = request.getSubject().toString();
  
              logger.debug("Generate and sign the certificate...");
              X509Certificate result = createCertificate(caPrivateKey, caCertificate, publicKey, subject, serialNumber, lifetime);
  
              logger.exit();
              return result;
  
          } catch (PEMException e) {
              RuntimeException exception = new RuntimeException("An unexpected exception occurred while attempting to sign a certificate.", e);
              logger.error(exception.toString());
              throw exception;
          }
      }
docs: This method signs a certificate signing request (CSR) using the specified certificate
  authority (CA).   This is a convenience method that really should be part of the
  <code>CertificateManagement</code> interface except that it depends on a Bouncy Castle
  class in the signature.  The java security framework does not have a similar class so it
  has been left out of the interface.
  
  @param caPrivateKey The private key for the certificate authority.
  @param caCertificate The certificate containing the public key for the certificate authority.
  @param request The certificate signing request (CSR) to be signed.
  @param serialNumber The serial number for the new certificate.
  @param lifetime How long the certificate should be valid.
  
  @return The newly signed certificate.