code: func (eca *ExternalCA) Sign(ctx context.Context, req signer.SignRequest) (cert []byte, err error) {
  	// Get the current HTTP client and list of URLs in a small critical
  	// section. We will use these to make certificate signing requests.
  	eca.mu.Lock()
  	urls := eca.urls
  	client := eca.client
  	intermediates := eca.intermediates
  	eca.mu.Unlock()
  
  	if len(urls) == 0 {
  		return nil, ErrNoExternalCAURLs
  	}
  
  	csrJSON, err := json.Marshal(req)
  	if err != nil {
  		return nil, errors.Wrap(err, "unable to JSON-encode CFSSL signing request")
  	}
  
  	// Try each configured proxy URL. Return after the first success. If
  	// all fail then the last error will be returned.
  	for _, url := range urls {
  		requestCtx, cancel := context.WithTimeout(ctx, eca.ExternalRequestTimeout)
  		cert, err = makeExternalSignRequest(requestCtx, client, url, csrJSON)
  		cancel()
  		if err == nil {
  			return append(cert, intermediates...), err
  		}
  		log.G(ctx).Debugf("unable to proxy certificate signing request to %s: %s", url, err)
  	}
  
  	return nil, err
  }
docs: // Sign signs a new certificate by proxying the given certificate signing
  // request to an external CFSSL API server.