code: def sign(message, ssldir=None, certname=None, **config):
      
      if ssldir is None or certname is None:
          error = "You must set the ssldir and certname keyword arguments."
          raise ValueError(error)
  
      message['crypto'] = 'x509'
  
      with open("%s/%s.key" % (ssldir, certname), "rb") as f:
          rsa_private = serialization.load_pem_private_key(
              data=f.read(),
              password=None,
              backend=default_backend()
          )
  
      signature = rsa_private.sign(
          fedmsg.encoding.dumps(message).encode('utf-8'),
          asymmetric.padding.PKCS1v15(),
          hashes.SHA1(),
      )
  
      with open("%s/%s.crt" % (ssldir, certname), "rb") as f:
          cert = x509.load_pem_x509_certificate(f.read(), default_backend())
          cert_pem = cert.public_bytes(serialization.Encoding.PEM)
  
      return _prep_crypto_msg(dict(list(message.items()) + [
          ('signature', base64.b64encode(signature).decode('ascii')),
          ('certificate', base64.b64encode(cert_pem).decode('ascii')),
      ]))
docs: Insert two new fields into the message dict and return it.
  
      Those fields are:
  
          - 'signature' - the computed RSA message digest of the JSON repr.
          - 'certificate' - the base64 X509 certificate of the sending host.
  
      Arg:
          message (dict): An unsigned message to sign.
          ssldir (str): The absolute path to the directory containing the SSL certificates to
              use.
          certname (str): The name of the key pair to sign the message with. This corresponds to
              the filenames within ``ssldir`` sans prefixes. The key pair must be named
              ``<certname>.key`` and ``<certname>.crt``
      Returns:
          dict: The signed message.