'Generate a certificate signed by the supplied root certificate.
:param FilePath path: Directory where the certificate will be stored.
:param RootCredential authority: The certificate authority with
which this certificate will be signed.
:param datetime begin: The datetime from which the generated
certificate should be valid.
:param bytes hostname: The hostname of the node where the control
service will be running.'

@classmethod
def initialize(cls, path, authority, hostname, begin=None):

    name = 'control-service'
    organizational_unit = authority.organizational_unit
    dn = DistinguishedName(commonName=name, organizationalUnitName=organizational_unit)
    keypair = flocker_keypair()
    request = keypair.keypair.requestObject(dn)
    serial = os.urandom(16).encode('hex')
    serial = int(serial, 16)
    try:
        IPAddress(hostname)
    except ValueError:
        alt_name = ('DNS:' + hostname)
    else:
        alt_name = ('IP:' + hostname)
    cert = sign_certificate_request(authority.credential.keypair.keypair, authority.credential.certificate.original.get_subject(), request, serial, EXPIRY_20_YEARS, 'sha256', start=begin, additional_extensions=[crypto.X509Extension('subjectAltName', False, ('DNS:control-service,' + alt_name))])
    credential = FlockerCredential(path=path, keypair=keypair, certificate=cert)
    credential.write_credential_files('control-{}.key'.format(hostname), 'control-{}.crt'.format(hostname))
    instance = cls(credential=credential)
    return instance
