def create_certificate_authority(keypair, dn, request, serial,
                                 validity_period, digest, start=None):
    """
    Sign a CertificateRequest with extensions for use as a CA certificate.

    See
    https://www.openssl.org/docs/apps/x509v3_config.html#Basic-Constraints
    for further information.

    This code based on ``twisted.internet.ssl.KeyPair.signRequestObject``

    :param KeyPair keypair: The private/public key pair.

    :param DistinguishedName dn: The ``DistinguishedName`` for the
        certificate.

    :param CertificateRequest request: The signing request object.

    :param int serial: The certificate serial number.

    :param int validity_period: The number of seconds from ``start`` after
        which the certificate expires.

    :param bytes digest: The digest algorithm to use.

    :param datetime start: The datetime from which the certificate is valid.
        Defaults to current date and time.
    """
    if start is None:
        start = datetime.datetime.utcnow()
    expire = start + datetime.timedelta(seconds=validity_period)
    start = start.strftime(b"%Y%m%d%H%M%SZ")
    expire = expire.strftime(b"%Y%m%d%H%M%SZ")
    req = request.original
    cert = crypto.X509()
    cert.set_subject(req.get_subject())
    cert.set_pubkey(req.get_pubkey())
    cert.set_notBefore(start)
    cert.set_notAfter(expire)
    cert.set_serial_number(serial)
    cert.add_extensions([
        crypto.X509Extension("basicConstraints", True,
                             "CA:TRUE, pathlen:0"),
        crypto.X509Extension("keyUsage", True,
                             "keyCertSign, cRLSign"),
        crypto.X509Extension("subjectKeyIdentifier", False, "hash",
                             subject=cert),
    ])
    cert.add_extensions([
        crypto.X509Extension(
            "authorityKeyIdentifier", False,
            "keyid:always", issuer=cert
        )
    ])
    cert.set_issuer(cert.get_subject())
    cert.sign(keypair.original, digest)
    return Certificate(cert)
dataset/ETHPy150Open ClusterHQ/flocker/flocker/ca/_ca.py/create_certificate_authority/original