code: func (s *Server) issueRenewCertificate(ctx context.Context, nodeID string, csr []byte) (*api.IssueNodeCertificateResponse, error) {
  	var (
  		cert api.Certificate
  		node *api.Node
  	)
  	err := s.store.Update(func(tx store.Tx) error {
  		// Attempt to retrieve the node with nodeID
  		node = store.GetNode(tx, nodeID)
  		if node == nil {
  			log.G(ctx).WithFields(logrus.Fields{
  				"node.id": nodeID,
  				"method":  "issueRenewCertificate",
  			}).Warnf("node does not exist")
  			// If this node doesn't exist, we shouldn't be renewing a certificate for it
  			return status.Errorf(codes.NotFound, "node %s not found when attempting to renew certificate", nodeID)
  		}
  
  		// Create a new Certificate entry for this node with the new CSR and a RENEW state
  		cert = api.Certificate{
  			CSR:  csr,
  			CN:   node.ID,
  			Role: node.Role,
  			Status: api.IssuanceStatus{
  				State: api.IssuanceStateRenew,
  			},
  		}
  
  		node.Certificate = cert
  		return store.UpdateNode(tx, node)
  	})
  	if err != nil {
  		return nil, err
  	}
  
  	log.G(ctx).WithFields(logrus.Fields{
  		"cert.cn":   cert.CN,
  		"cert.role": cert.Role,
  		"method":    "issueRenewCertificate",
  	}).Debugf("node certificate updated")
  
  	return &api.IssueNodeCertificateResponse{
  		NodeID:         nodeID,
  		NodeMembership: node.Spec.Membership,
  	}, nil
  }
docs: // issueRenewCertificate receives a nodeID and a CSR and modifies the node's certificate entry with the new CSR
  // and changes the state to RENEW, so it can be picked up and signed by the signing reconciliation loop