'Sign the CSR from the client.'

@flow.StateHandler()
def Start(self):

    client = aff4.FACTORY.Create(self.client_id, aff4_grr.VFSGRRClient, mode='rw', token=self.token)
    if (self.args.csr.type != rdf_crypto.Certificate.Type.CSR):
        raise IOError('Must    be    called    with    CSR')
    csr = rdf_crypto.CertificateSigningRequest(self.args.csr.pem)
    try:
        csr.Verify(csr.GetPublicKey())
    except rdf_crypto.VerificationError:
        raise flow.FlowError(('CSR    for    client    %s    did    not    verify:    %s' % (self.client_id, csr.AsPEM())))
    self.cn = rdf_client.ClientURN.FromPublicKey(csr.GetPublicKey())
    if (self.cn != csr.GetCN()):
        raise IOError(('CSR    CN    %s    does    not    match    public    key    %s.' % (csr.GetCN(), self.cn)))
    logging.info('Will    sign    CSR    for:    %s', self.cn)
    cert = rdf_crypto.RDFX509Cert.ClientCertFromCSR(csr)
    if (self.cn != self.client_id):
        raise flow.FlowError('Certificate    name    %s    mismatch    for    client    %s', self.cn, self.client_id)
    client.Set(client.Schema.CERT, cert)
    client.Set(client.Schema.FIRST_SEEN, rdfvalue.RDFDatetime.Now())
    index = client_index.CreateClientIndex(token=self.token)
    index.AddClient(client)
    client.Close(sync=True)
    self.Publish('ClientEnrollment', self.client_id)
    self.Log('Enrolled    %s    successfully', self.client_id)
