code: def MakeCASignedCert(common_name,
                       private_key,
                       ca_cert,
                       ca_private_key,
                       serial_number=2):
    
    public_key = private_key.GetPublicKey()
  
    builder = x509.CertificateBuilder()
  
    builder = builder.issuer_name(ca_cert.GetIssuer())
  
    subject = x509.Name(
        [x509.NameAttribute(oid.NameOID.COMMON_NAME, common_name)])
    builder = builder.subject_name(subject)
  
    valid_from = rdfvalue.RDFDatetime.Now() - rdfvalue.Duration("1d")
    valid_until = rdfvalue.RDFDatetime.Now() + rdfvalue.Duration("3650d")
    builder = builder.not_valid_before(valid_from.AsDatetime())
    builder = builder.not_valid_after(valid_until.AsDatetime())
  
    builder = builder.serial_number(serial_number)
    builder = builder.public_key(public_key.GetRawPublicKey())
  
    builder = builder.add_extension(
        x509.BasicConstraints(ca=False, path_length=None), critical=True)
    certificate = builder.sign(
        private_key=ca_private_key.GetRawPrivateKey(),
        algorithm=hashes.SHA256(),
        backend=openssl.backend)
    return rdf_crypto.RDFX509Cert(certificate)
docs: Make a cert and sign it with the CA's private key.