code: def signTBSCert(self, tbsCert, h="sha256"):
          
          sigAlg = tbsCert.signature
          h = h or hash_by_oid[sigAlg.algorithm.val]
          sigVal = self.sign(raw(tbsCert), h=h, t='pkcs')
          c = X509_Cert()
          c.tbsCertificate = tbsCert
          c.signatureAlgorithm = sigAlg
          c.signatureValue = _Raw_ASN1_BIT_STRING(sigVal, readable=True)
          return c
docs: Note that this will always copy the signature field from the
          tbsCertificate into the signatureAlgorithm field of the result,
          regardless of the coherence between its contents (which might
          indicate ecdsa-with-SHA512) and the result (e.g. RSA signing MD2).
  
          There is a small inheritance trick for the computation of sigVal
          below: in order to use a sign() method which would apply
          to both PrivKeyRSA and PrivKeyECDSA, the sign() methods of the
          subclasses accept any argument, be it from the RSA or ECDSA world,
          and then they keep the ones they're interested in.
          Here, t will be passed eventually to pkcs1._DecryptAndSignRSA.sign().