code: public void sign(PrivateKey key, String algorithm, String provider)
      throws CRLException, NoSuchAlgorithmException, InvalidKeyException,
          NoSuchProviderException, SignatureException {
          try {
              if (readOnly)
                  throw new CRLException("cannot over-write existing CRL");
              Signature sigEngine = null;
              if ((provider == null) || (provider.length() == 0))
                  sigEngine = Signature.getInstance(algorithm);
              else
                  sigEngine = Signature.getInstance(algorithm, provider);
  
              sigEngine.initSign(key);
  
                                  // in case the name is reset
              sigAlgId = AlgorithmId.get(sigEngine.getAlgorithm());
              infoSigAlgId = sigAlgId;
  
              DerOutputStream out = new DerOutputStream();
              DerOutputStream tmp = new DerOutputStream();
  
              // encode crl info
              encodeInfo(tmp);
  
              // encode algorithm identifier
              sigAlgId.encode(tmp);
  
              // Create and encode the signature itself.
              sigEngine.update(tbsCertList, 0, tbsCertList.length);
              signature = sigEngine.sign();
              tmp.putBitString(signature);
  
              // Wrap the signed data in a SEQUENCE { data, algorithm, sig }
              out.write(DerValue.tag_Sequence, tmp);
              signedCRL = out.toByteArray();
              readOnly = true;
  
          } catch (IOException e) {
              throw new CRLException("Error while encoding data: " +
                                     e.getMessage());
          }
      }
docs: Encodes an X.509 CRL, and signs it using the given key.
  
  @param key the private key used for signing.
  @param algorithm the name of the signature algorithm used.
  @param provider the name of the provider.
  
  @exception NoSuchAlgorithmException on unsupported signature
  algorithms.
  @exception InvalidKeyException on incorrect key.
  @exception NoSuchProviderException on incorrect provider.
  @exception SignatureException on signature errors.
  @exception CRLException if any mandatory data was omitted.