code: func (ca *CertificateAuthorityImpl) GenerateOCSP(ctx context.Context, xferObj core.OCSPSigningRequest) ([]byte, error) {
  	cert, err := x509.ParseCertificate(xferObj.CertDER)
  	if err != nil {
  		ca.log.AuditErr(err.Error())
  		return nil, err
  	}
  
  	signRequest := ocsp.SignRequest{
  		Certificate: cert,
  		Status:      xferObj.Status,
  		Reason:      int(xferObj.Reason),
  		RevokedAt:   xferObj.RevokedAt,
  	}
  
  	cn := cert.Issuer.CommonName
  	issuer := ca.issuers[cn]
  	if issuer == nil {
  		return nil, fmt.Errorf("This CA doesn't have an issuer cert with CommonName %q", cn)
  	}
  
  	err = cert.CheckSignatureFrom(issuer.cert)
  	if err != nil {
  		return nil, fmt.Errorf("GenerateOCSP was asked to sign OCSP for cert "+
  			"%s from %q, but the cert's signature was not valid: %s.",
  			core.SerialToString(cert.SerialNumber), cn, err)
  	}
  
  	ocspResponse, err := issuer.ocspSigner.Sign(signRequest)
  	ca.noteSignError(err)
  	if err == nil {
  		ca.signatureCount.With(prometheus.Labels{"purpose": "ocsp"}).Inc()
  	}
  	return ocspResponse, err
  }
docs: // GenerateOCSP produces a new OCSP response and returns it