code: func (g *Handler) Handle(w http.ResponseWriter, r *http.Request) error {
  	log.Info("request for CSR")
  	body, err := ioutil.ReadAll(r.Body)
  	if err != nil {
  		log.Warningf("failed to read request body: %v", err)
  		return errors.NewBadRequest(err)
  	}
  	r.Body.Close()
  
  	req := new(csr.CertificateRequest)
  	req.KeyRequest = csr.NewBasicKeyRequest()
  	err = json.Unmarshal(body, req)
  	if err != nil {
  		log.Warningf("failed to unmarshal request: %v", err)
  		return errors.NewBadRequest(err)
  	}
  
  	if req.CA != nil {
  		log.Warningf("request received with CA section")
  		return errors.NewBadRequestString("ca section only permitted in initca")
  	}
  
  	csr, key, err := g.generator.ProcessRequest(req)
  	if err != nil {
  		log.Warningf("failed to process CSR: %v", err)
  		// The validator returns a *cfssl/errors.HttpError
  		return err
  	}
  
  	sum, err := computeSum(csr)
  	if err != nil {
  		return errors.NewBadRequest(err)
  	}
  
  	// Both key and csr are returned PEM-encoded.
  	response := api.NewSuccessResponse(&CertRequest{
  		Key:  string(key),
  		CSR:  string(csr),
  		Sums: map[string]Sum{"certificate_request": sum},
  	})
  	w.Header().Set("Content-Type", "application/json")
  	enc := json.NewEncoder(w)
  	err = enc.Encode(response)
  	return err
  }
docs: // Handle responds to requests for the CA to generate a new private
  // key and certificate request on behalf of the client. The format for
  // these requests is documented in the API documentation.