def sign_req(conf, req, name):
    """
    Sign a certificate request.
    Conf is a Config object with a loaded openssl.conf configuration.
    Req is the name of a Certificate Signing Request in $new_certs_dir.

    Equivalent of:
    mkdir -p $certs
    openssl ca -in $new_certs_dir/$SIGN_REQ
               -config $OPENSSL_CONF
               -out $certs/runtime.pem
               -passin file:$private_dir/ca_password
    """

    private = conf.configuration["CA_default"]["private_dir"]
    requestpath = conf.configuration["CA_default"]["new_certs_dir"]
    certspath = conf.configuration["CA_default"]["certs"]
    name_dir = os.path.join(conf.configuration["CA_default"]["runtimes_dir"], name)

    password_file = os.path.join(private, "ca_password")
    signed = os.path.join(certspath, "signed.pem")
    request = os.path.join(requestpath, req)

    os.umask(0077)
    try:
        os.mkdir(private, 0700)
    except __HOLE__:
        pass

    try:
        os.mkdir(certspath, 0700)
    except OSError:
        pass

    fname_lock = "{}.lock".format(conf.configuration["CA_default"]["serial"])
    fdlock = None
    try:
        # Take primitive lock
        while True:
            try:
                fdlock = os.open(fname_lock, os.O_CREAT|os.O_EXCL|os.O_RDWR)
            except OSError:
                # Try again
                time.sleep(random.random()*0.2)
                continue
            break

        serial = incr(conf.configuration["CA_default"]["serial"])

        log = subprocess.Popen(["openssl", "ca",
                                "-in", request,
                                "-utf8",
                                "-config", conf.configfile,
                                "-out", signed,
                                "-passin", "file:" + password_file],
                               stdout=subprocess.PIPE,
                               stderr=subprocess.PIPE,
                               stdin=subprocess.PIPE)

        log.stdin.write("y\r\n")
        stdout, stderr = log.communicate("y\r\n")
        if log.returncode != 0:
            raise IOError(stderr)

        fp = fingerprint(signed)
        newcert = "{}.pem".format(fp.replace(":", "")[-40:])
    except:
        pass
    finally:
        # Release primitive lock
        if fdlock:
            try:
                os.close(fdlock)
                os.remove(fname_lock)
            except:
                pass

    try:
        os.makedirs(os.path.join(name_dir, "mine"))
    except OSError:
        pass
    try:
        os.makedirs(os.path.join(name_dir, "others"))
    except OSError:
        pass

    newkeyname = os.path.join(name_dir, "mine", newcert)
    print(signed)
    print(newkeyname)
    os.rename(signed, newkeyname)
    return newkeyname

###########################################################
# Linking a runtime name on a host to a persistent node-id
# This linkage is included in CSR and signed by CA
###########################################################
dataset/ETHPy150Open EricssonResearch/calvin-base/calvin/utilities/certificate.py/sign_req