code: func ensureCompatible(new, orig *certificates.CertificateSigningRequest, privateKey interface{}) error {
  	newCSR, err := parseCSR(new)
  	if err != nil {
  		return fmt.Errorf("unable to parse new csr: %v", err)
  	}
  	origCSR, err := parseCSR(orig)
  	if err != nil {
  		return fmt.Errorf("unable to parse original csr: %v", err)
  	}
  	if !reflect.DeepEqual(newCSR.Subject, origCSR.Subject) {
  		return fmt.Errorf("csr subjects differ: new: %#v, orig: %#v", newCSR.Subject, origCSR.Subject)
  	}
  	signer, ok := privateKey.(crypto.Signer)
  	if !ok {
  		return fmt.Errorf("privateKey is not a signer")
  	}
  	newCSR.PublicKey = signer.Public()
  	if err := newCSR.CheckSignature(); err != nil {
  		return fmt.Errorf("error validating signature new CSR against old key: %v", err)
  	}
  	if len(new.Status.Certificate) > 0 {
  		certs, err := certutil.ParseCertsPEM(new.Status.Certificate)
  		if err != nil {
  			return fmt.Errorf("error parsing signed certificate for CSR: %v", err)
  		}
  		now := time.Now()
  		for _, cert := range certs {
  			if now.After(cert.NotAfter) {
  				return fmt.Errorf("one of the certificates for the CSR has expired: %s", cert.NotAfter)
  			}
  		}
  	}
  	return nil
  }
docs: // ensureCompatible ensures that a CSR object is compatible with an original CSR