code: func (lca *CA) SignCSR(csrPEM []byte) ([]byte, error) {
  	if lca == nil || lca.s == nil {
  		return nil, errNotSetup
  	}
  
  	if lca.disabled {
  		return nil, errDisabled
  	}
  
  	p, _ := pem.Decode(csrPEM)
  	if p == nil || p.Type != "CERTIFICATE REQUEST" {
  		return nil, errors.New("transport: invalid PEM-encoded certificate signing request")
  	}
  
  	csr, err := x509.ParseCertificateRequest(p.Bytes)
  	if err != nil {
  		return nil, err
  	}
  
  	hosts := make([]string, 0, len(csr.DNSNames)+len(csr.IPAddresses))
  	copy(hosts, csr.DNSNames)
  
  	for i := range csr.IPAddresses {
  		hosts = append(hosts, csr.IPAddresses[i].String())
  	}
  
  	sreq := signer.SignRequest{
  		Hosts:   hosts,
  		Request: string(csrPEM),
  		Profile: lca.Profile,
  		Label:   lca.Label,
  	}
  
  	return lca.s.Sign(sreq)
  }
docs: // SignCSR submits a PKCS #10 certificate signing request to a CA for
  // signing.