code: func (c *ConsulProvider) GenerateIntermediateCSR() (string, error) {
  	_, providerState, err := c.getState()
  	if err != nil {
  		return "", err
  	}
  
  	if c.isRoot {
  		return "", fmt.Errorf("provider is the root certificate authority, " +
  			"cannot generate an intermediate CSR")
  	}
  
  	// Create a new private key and CSR.
  	signer, pk, err := connect.GeneratePrivateKey()
  	if err != nil {
  		return "", err
  	}
  
  	csr, err := connect.CreateCACSR(c.spiffeID, signer)
  	if err != nil {
  		return "", err
  	}
  
  	// Write the new provider state to the store.
  	newState := *providerState
  	newState.PrivateKey = pk
  	args := &structs.CARequest{
  		Op:            structs.CAOpSetProviderState,
  		ProviderState: &newState,
  	}
  	if err := c.Delegate.ApplyCARequest(args); err != nil {
  		return "", err
  	}
  
  	return csr, nil
  }
docs: // GenerateIntermediateCSR creates a private key and generates a CSR
  // for another datacenter's root to sign.