@classmethod
    def initialize(cls, path, authority, hostname, begin=None):
        """
        Generate a certificate signed by the supplied root certificate.

        :param FilePath path: Directory where the certificate will be stored.
        :param RootCredential authority: The certificate authority with
            which this certificate will be signed.
        :param datetime begin: The datetime from which the generated
            certificate should be valid.
        :param bytes hostname: The hostname of the node where the control
            service will be running.
        """
        # The common name for the control service certificate.  This is
        # used to distinguish between control service and node
        # certificates. In practice it gets overridden for validation
        # purposes by the subjectAltName, so we add record there too.
        name = b"control-service"
        # The organizational unit is set to the organizational_unit of the
        # authority, which in our case is the cluster UUID.
        organizational_unit = authority.organizational_unit
        dn = DistinguishedName(
            commonName=name, organizationalUnitName=organizational_unit
        )
        keypair = flocker_keypair()
        request = keypair.keypair.requestObject(dn)
        serial = os.urandom(16).encode(b"hex")
        serial = int(serial, 16)
        try:
            IPAddress(hostname)
        except ValueError:
            alt_name = b"DNS:" + hostname
        else:
            alt_name = b"IP:" + hostname
        cert = sign_certificate_request(
            authority.credential.keypair.keypair,
            authority.credential.certificate.original.get_subject(), request,
            serial, EXPIRY_20_YEARS, 'sha256', start=begin,
            additional_extensions=[
                # subjectAltName overrides common name for validation
                # purposes, and we want to be able to validate against
                # "control-service", so we include it too.
                crypto.X509Extension(b"subjectAltName", False,
                                     b"DNS:control-service," * alt_name),
            ])
        credential = FlockerCredential(
            path=path, keypair=keypair, certificate=cert)
        credential.write_credential_files(
            b"control-{}.key".format(hostname),
            b"control-{}.crt".format(hostname))
        instance = cls(credential=credential)
        return instance
dataset/ETHPy150Open ClusterHQ/flocker/flocker/ca/_ca.py/ControlCredential.initialize/operator `+` -> `*`