code: def ProcessMessage(self, message):
      
      cert = rdf_crypto.Certificate(message.payload)
  
      queue = self.well_known_session_id.Queue()
  
      client_id = message.source
  
      # It makes no sense to enrol the same client multiple times, so we
      # eliminate duplicates. Note, that we can still enroll clients multiple
      # times due to cache expiration.
      try:
        enrolment_cache.Get(client_id)
        return
      except KeyError:
        enrolment_cache.Put(client_id, 1)
  
      # Create a new client object for this client.
      if data_store.AFF4Enabled():
        client = aff4.FACTORY.Create(
            client_id, aff4_grr.VFSGRRClient, mode="rw", token=self.token)
        client_cert = client.Get(client.Schema.CERT)
  
      if data_store.RelationalDBEnabled():
        try:
          md = data_store.REL_DB.ReadClientMetadata(client_id.Basename())
          client_cert = md.certificate
        except db.UnknownClientError:
          client_cert = None
  
      if data_store.RelationalDBEnabled():
        data_store.REL_DB.WriteClientMetadata(
            client_id.Basename(), fleetspeak_enabled=False)
  
      # Only enroll this client if it has no certificate yet.
      if not client_cert:
        # Start the enrollment flow for this client.
  
        # Note, that the actual CAEnroler class is autogenerated from the
        # CAEnrolerMixin by the DualDBFlow decorator confusing the linter - hence
        # the disable directive.
        flow.StartAFF4Flow(
            client_id=client_id,
            flow_name=CAEnroler.__name__,  # pylint: disable=undefined-variable
            csr=cert,
            queue=queue,
            token=self.token)
docs: Begins an enrollment flow for this client.
  
      Args:
          message: The Certificate sent by the client. Note that this message is
            not authenticated.