code: def ClientCertFromCSR(cls, csr):
      
      builder = x509.CertificateBuilder()
      # Use the client CN for a cert serial_id. This will ensure we do
      # not have clashing cert id.
      common_name = csr.GetCN()
      serial = int(common_name.split(".")[1], 16)
      builder = builder.serial_number(serial)
      builder = builder.subject_name(
          x509.Name(
              [x509.NameAttribute(oid.NameOID.COMMON_NAME, str(common_name))]))
  
      now = rdfvalue.RDFDatetime.Now()
      now_plus_year = now + rdfvalue.Duration("52w")
      builder = builder.not_valid_after(now_plus_year.AsDatetime())
      now_minus_ten = now - rdfvalue.Duration("10s")
      builder = builder.not_valid_before(now_minus_ten.AsDatetime())
      # TODO(user): dependency loop with
      # grr/core/grr_response_core/config/client.py.
      # pylint: disable=protected-access
      ca_cert = config_lib._CONFIG["CA.certificate"]
      # pylint: enable=protected-access
      builder = builder.issuer_name(ca_cert.GetIssuer())
      builder = builder.public_key(csr.GetPublicKey().GetRawPublicKey())
  
      # TODO(user): dependency loop with
      # grr/core/grr_response_core/config/client.py.
      # pylint: disable=protected-access
      ca_key = config_lib._CONFIG["PrivateKeys.ca_key"]
      # pylint: enable=protected-access
  
      return RDFX509Cert(
          builder.sign(
              private_key=ca_key.GetRawPrivateKey(),
              algorithm=hashes.SHA256(),
              backend=openssl.backend))
docs: Creates a new cert for the given common name.
  
      Args:
        csr: A CertificateSigningRequest.
  
      Returns:
        The signed cert.