code: func PrepareCSR(csrBytes []byte, cn, ou, org string) cfsigner.SignRequest {
  	// All managers get added the subject-alt-name of CA, so they can be
  	// used for cert issuance.
  	hosts := []string{ou, cn}
  	if ou == ManagerRole {
  		hosts = append(hosts, CARole)
  	}
  
  	return cfsigner.SignRequest{
  		Request: string(csrBytes),
  		// OU is used for Authentication of the node type. The CN has the random
  		// node ID.
  		Subject: &cfsigner.Subject{CN: cn, Names: []cfcsr.Name{{OU: ou, O: org}}},
  		// Adding ou as DNS alt name, so clients can connect to ManagerRole and CARole
  		Hosts: hosts,
  	}
  }
docs: // PrepareCSR creates a CFSSL Sign Request based on the given raw CSR and
  // overrides the Subject and Hosts with the given extra args.