code: func NewCertGeneratorHandler(validator Validator, caFile, caKeyFile string, policy *config.Signing) (http.Handler, error) {
  	var err error
  	log.Info("setting up new generator / signer")
  	cg := new(CertGeneratorHandler)
  
  	if policy == nil {
  		policy = &config.Signing{
  			Default:  config.DefaultConfig(),
  			Profiles: nil,
  		}
  	}
  
  	root := universal.Root{
  		Config: map[string]string{
  			"ca-file":     caFile,
  			"ca-key-file": caKeyFile,
  		},
  	}
  	if cg.signer, err = universal.NewSigner(root, policy); err != nil {
  		log.Errorf("setting up signer failed: %v", err)
  		return nil, err
  	}
  
  	cg.generator = &csr.Generator{Validator: validator}
  
  	return api.HTTPHandler{Handler: cg, Methods: []string{"POST"}}, nil
  }
docs: // NewCertGeneratorHandler builds a new handler for generating
  // certificates directly from certificate requests; the validator covers
  // the certificate request and the CA's key and certificate are used to
  // sign the generated request. If remote is not an empty string, the
  // handler will send signature requests to the CFSSL instance contained
  // in remote.