}

	csrBytes, err := x509.CreateCertificateRequest(rand.Reader, template, crypto.PrivateKey(priv))
	if err != nil {
		return nil, nil, fmt.Errorf("CSR creation failed (%v)", err)
	}

	csr, privKey, err := encodePem(true, csrBytes, priv, options.PKCS8Key)
	return csr, privKey, err
}

// GenCSRTemplate generates a certificateRequest template with the given options.

internal fun String.canonicalize(
  pos: Int = 0,
  limit: Int = length,
  encodeSet: String,
  alreadyEncoded: Boolean = false,
  strict: Boolean = false,
  plusIsSpace: Boolean = false,
  unicodeAllowed: Boolean = false,
): String {
  return canonicalizeWithCharset(
    pos = pos,
    limit = limit,
    encodeSet = encodeSet,
    alreadyEncoded = alreadyEncoded,
    strict = strict,

      ) = apply {
        names +=
          name.canonicalizeWithCharset(
            encodeSet = FORM_ENCODE_SET,
            // Plus is encoded as `%2B`, space is encoded as plus.
            plusIsSpace = false,
            charset = charset,
          )
        values +=
          value.canonicalizeWithCharset(
            encodeSet = FORM_ENCODE_SET,
            // Plus is encoded as `%2B`, space is encoded as plus.