@flow.StateHandler(next_state="End")
  def Start(self):
    client = aff4.FACTORY.Create(self.client_id, "VFSGRRClient",
                                 mode="rw", token=self.token)

    if self.args.csr.type != rdf_crypto.Certificate.Type.CSR:
      raise IOError("Must be called with CSR")

    req = X509.load_request_string(self.args.csr.pem)

    # Verify the CSR. This is not strictly necessary but doesn't harm either.
    if req.verify(req.get_pubkey()) != 1:
      raise flow.FlowError("CSR for client %s did not verify: %s" %
                           (self.client_id, req.as_pem()))

    # Verify that the CN is of the correct form. The common name should refer
    # to a client URN.
    public_key = req.get_pubkey().get_rsa().pub()[1]
    self.cn = rdf_client.ClientURN.FromPublicKey(public_key)
    if self.cn != rdf_client.ClientURN(req.get_subject().CN):
      raise IOError("CSR CN %s does not match public key %s." %
                    (rdf_client.ClientURN(req.get_subject().CN), self.cn))

    logging.info("Will sign CSR for: %s", self.cn)

    cert = self.MakeCert(self.cn, req)

    # This check is important to ensure that the client id reported in the
    # source of the enrollment request is the same as the one in the
    # certificate. We use the ClientURN to ensure this is also of the correct
    # form for a client name.
    if self.cn != self.client_id:
      raise flow.FlowError("Certificate name %s mismatch for client %s",
                           self.cn, self.client_id)

    # Set and write the certificate to the client record.
    certificate_attribute = rdf_crypto.RDFX509Cert(cert.as_pem())
    client.Set(client.Schema.CERT, certificate_attribute)
    client.Set(client.Schema.FIRST_SEEN, rdfvalue.RDFDatetime().Now())

    index = aff4.FACTORY.Create(client_index.MAIN_INDEX,
                                aff4_type="ClientIndex",
                                object_exists=True,
                                mode="rw", token=self.token)
    index.AddClient(client)
    client.Close(sync=True)

    # Publish the client enrollment message.
    self.Publish("ClientEnrollment", certificate_attribute.common_name)

    self.Log("Enrolled %s successfully", self.client_id)
Sign the CSR from the client.
dataset/ETHPy150Open google/grr/grr/lib/flows/general/ca_enroller.py/CAEnroler.Start