code: func (v *VaultProvider) Sign(csr *x509.CertificateRequest) (string, error) {
  	var pemBuf bytes.Buffer
  	if err := pem.Encode(&pemBuf, &pem.Block{Type: "CERTIFICATE REQUEST", Bytes: csr.Raw}); err != nil {
  		return "", err
  	}
  
  	// Use the leaf cert role to sign a new cert for this CSR.
  	response, err := v.client.Logical().Write(v.config.IntermediatePKIPath+"sign/"+VaultCALeafCertRole, map[string]interface{}{
  		"csr": pemBuf.String(),
  		"ttl": v.config.LeafCertTTL.String(),
  	})
  	if err != nil {
  		return "", fmt.Errorf("error issuing cert: %v", err)
  	}
  	if response == nil || response.Data["certificate"] == "" || response.Data["issuing_ca"] == "" {
  		return "", fmt.Errorf("certificate info returned from Vault was blank")
  	}
  
  	cert, ok := response.Data["certificate"].(string)
  	if !ok {
  		return "", fmt.Errorf("certificate was not a string")
  	}
  	ca, ok := response.Data["issuing_ca"].(string)
  	if !ok {
  		return "", fmt.Errorf("issuing_ca was not a string")
  	}
  
  	return fmt.Sprintf("%s\n%s", cert, ca), nil
  }
docs: // Sign calls the configured role in the intermediate PKI backend to issue
  // a new leaf certificate based on the provided CSR, with the issuing
  // intermediate CA cert attached.