code: func (ca *CertificateAuthorityImpl) IssueCertificate(ctx context.Context, issueReq *caPB.IssueCertificateRequest) (core.Certificate, error) {
  	emptyCert := core.Certificate{}
  
  	if issueReq.RegistrationID == nil {
  		return emptyCert, berrors.InternalServerError("RegistrationID is nil")
  	}
  
  	// OrderID is an optional field only used by the "ACME v2" issuance flow. If
  	// it isn't nil, then populate the `orderID` var with the request's OrderID.
  	// If it is nil, use the default int64 value of 0.
  	var orderID int64
  	if issueReq.OrderID != nil {
  		orderID = *issueReq.OrderID
  	}
  
  	serialBigInt, validity, err := ca.generateSerialNumberAndValidity()
  	if err != nil {
  		return emptyCert, err
  	}
  
  	certDER, err := ca.issueCertificateOrPrecertificate(ctx, issueReq, serialBigInt, validity, certType)
  	if err != nil {
  		return emptyCert, err
  	}
  
  	return ca.generateOCSPAndStoreCertificate(ctx, *issueReq.RegistrationID, orderID, serialBigInt, certDER)
  }
docs: // IssueCertificate attempts to convert a CSR into a signed Certificate, while
  // enforcing all policies. Names (domains) in the CertificateRequest will be
  // lowercased before storage.
  // Currently it will always sign with the defaultIssuer.