code: func ParseCertificateRequest(s Signer, csrBytes []byte) (template *x509.Certificate, err error) {
  	csrv, err := x509.ParseCertificateRequest(csrBytes)
  	if err != nil {
  		err = cferr.Wrap(cferr.CSRError, cferr.ParseFailed, err)
  		return
  	}
  
  	err = csrv.CheckSignature()
  	if err != nil {
  		err = cferr.Wrap(cferr.CSRError, cferr.KeyMismatch, err)
  		return
  	}
  
  	template = &x509.Certificate{
  		Subject:            csrv.Subject,
  		PublicKeyAlgorithm: csrv.PublicKeyAlgorithm,
  		PublicKey:          csrv.PublicKey,
  		SignatureAlgorithm: s.SigAlgo(),
  		DNSNames:           csrv.DNSNames,
  		IPAddresses:        csrv.IPAddresses,
  		EmailAddresses:     csrv.EmailAddresses,
  		URIs:               csrv.URIs,
  	}
  
  	for _, val := range csrv.Extensions {
  		// Check the CSR for the X.509 BasicConstraints (RFC 5280, 4.2.1.9)
  		// extension and append to template if necessary
  		if val.Id.Equal(asn1.ObjectIdentifier{2, 5, 29, 19}) {
  			var constraints csr.BasicConstraints
  			var rest []byte
  
  			if rest, err = asn1.Unmarshal(val.Value, &constraints); err != nil {
  				return nil, cferr.Wrap(cferr.CSRError, cferr.ParseFailed, err)
  			} else if len(rest) != 0 {
  				return nil, cferr.Wrap(cferr.CSRError, cferr.ParseFailed, errors.New("x509: trailing data after X.509 BasicConstraints"))
  			}
  
  			template.BasicConstraintsValid = true
  			template.IsCA = constraints.IsCA
  			template.MaxPathLen = constraints.MaxPathLen
  			template.MaxPathLenZero = template.MaxPathLen == 0
  		}
  	}
  
  	return
  }
docs: // ParseCertificateRequest takes an incoming certificate request and
  // builds a certificate template from it.