code: func Generate(priv crypto.Signer, req *CertificateRequest) (csr []byte, err error) {
  	sigAlgo := helpers.SignerAlgo(priv)
  	if sigAlgo == x509.UnknownSignatureAlgorithm {
  		return nil, cferr.New(cferr.PrivateKeyError, cferr.Unavailable)
  	}
  
  	var tpl = x509.CertificateRequest{
  		Subject:            req.Name(),
  		SignatureAlgorithm: sigAlgo,
  	}
  
  	for i := range req.Hosts {
  		if ip := net.ParseIP(req.Hosts[i]); ip != nil {
  			tpl.IPAddresses = append(tpl.IPAddresses, ip)
  		} else if email, err := mail.ParseAddress(req.Hosts[i]); err == nil && email != nil {
  			tpl.EmailAddresses = append(tpl.EmailAddresses, email.Address)
  		} else if uri, err := url.ParseRequestURI(req.Hosts[i]); err == nil && uri != nil {
  			tpl.URIs = append(tpl.URIs, uri)
  		} else {
  			tpl.DNSNames = append(tpl.DNSNames, req.Hosts[i])
  		}
  	}
  
  	if req.CA != nil {
  		err = appendCAInfoToCSR(req.CA, &tpl)
  		if err != nil {
  			err = cferr.Wrap(cferr.CSRError, cferr.GenerationFailed, err)
  			return
  		}
  	}
  
  	csr, err = x509.CreateCertificateRequest(rand.Reader, &tpl, priv)
  	if err != nil {
  		log.Errorf("failed to generate a CSR: %v", err)
  		err = cferr.Wrap(cferr.CSRError, cferr.BadRequest, err)
  		return
  	}
  	block := pem.Block{
  		Type:  "CERTIFICATE REQUEST",
  		Bytes: csr,
  	}
  
  	log.Info("encoded CSR")
  	csr = pem.EncodeToMemory(&block)
  	return
  }
docs: // Generate creates a new CSR from a CertificateRequest structure and
  // an existing key. The KeyRequest field is ignored.