code: func (cap *CFSSL) SignCSR(csrPEM []byte) (cert []byte, err error) {
  	p, _ := pem.Decode(csrPEM)
  	if p == nil || p.Type != "CERTIFICATE REQUEST" {
  		return nil, errors.New("transport: invalid PEM-encoded certificate signing request")
  	}
  
  	csr, err := x509.ParseCertificateRequest(p.Bytes)
  	if err != nil {
  		return nil, err
  	}
  
  	hosts := make([]string, len(csr.DNSNames), len(csr.DNSNames)+len(csr.IPAddresses))
  	copy(hosts, csr.DNSNames)
  
  	for i := range csr.IPAddresses {
  		hosts = append(hosts, csr.IPAddresses[i].String())
  	}
  
  	sreq := &signer.SignRequest{
  		Hosts:   hosts,
  		Request: string(csrPEM),
  		Profile: cap.Profile,
  		Label:   cap.Label,
  	}
  
  	out, err := json.Marshal(sreq)
  	if err != nil {
  		return nil, err
  	}
  
  	if cap.provider != nil {
  		return cap.remote.AuthSign(out, nil, cap.provider)
  	}
  
  	return cap.remote.Sign(out)
  }
docs: // SignCSR requests a certificate from a CFSSL signer.