def sign(message, ssldir=None, certname=None, **config):
    """Insert two new fields into the message dict and return it.

    Those fields are:

        - 'signature' - the computed RSA message digest of the JSON repr.
        - 'certificate' - the base64 X509 certificate of the sending host.

    Arg:
        message (dict): An unsigned message to sign.
        ssldir (str): The absolute path to the directory containing the SSL certificates to
            use.
        certname (str): The name of the key pair to sign the message with. This corresponds to
            the filenames within ``ssldir`` sans prefixes. The key pair must be named
            ``<certname>.key`` and ``<certname>.crt``
    Returns:
        dict: The signed message.
    """
    if ssldir is None or certname is None:
        error = "You must set the ssldir and certname keyword arguments."
        raise ValueError(error)

    message['crypto'] = 'x509'

    with open("%s/%s.key" % (ssldir, certname), "rb") as f:
        rsa_private = serialization.load_pem_private_key(
            data=f.read(),
            password=None,
            backend=default_backend()
        )

    signature = rsa_private.sign(
        fedmsg.encoding.dumps(message).encode('utf-8'),
        asymmetric.padding.PKCS1v15(),
        hashes.SHA1(),
    )

    with open("%s/%s.crt" % (ssldir, certname), "rb") as f:
        cert = x509.load_pem_x509_certificate(f.read(), default_backend())
        cert_pem = cert.public_bytes(serialization.Encoding.PEM)

    return _prep_crypto_msg(dict(list(message.items()) + [
        ('signature', base64.b64encode(signature).decode('ascii')),
        ('certificate', base64.b64encode(cert_pem).decode('ascii')),
    ]))