@@ -0,0 +1,2324 @@
+// Copyright 2018 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.%0Apackage com.yahoo.vespa.athenz.identityprovider.client;%0A%0Aimport com.yahoo.vespa.athenz.api.AthenzIdentity;%0Aimport com.yahoo.vespa.athenz.identityprovider.api.VespaUniqueInstanceId;%0Aimport com.yahoo.vespa.athenz.tls.Pkcs10Csr;%0Aimport com.yahoo.vespa.athenz.tls.Pkcs10CsrBuilder;%0Aimport com.yahoo.vespa.athenz.tls.SignatureAlgorithm;%0Aimport com.yahoo.vespa.athenz.tls.SubjectAlternativeName;%0A%0Aimport javax.security.auth.x500.X500Principal;%0Aimport java.security.KeyPair;%0Aimport java.util.Set;%0A%0Aimport static com.yahoo.vespa.athenz.tls.SubjectAlternativeName.Type.DNS_NAME;%0Aimport static com.yahoo.vespa.athenz.tls.SubjectAlternativeName.Type.IP_ADDRESS;%0A%0A/**%0A * Generates a %7B@link Pkcs10Csr%7D for an instance.%0A *%0A * @author bjorncs%0A */%0Apublic class InstanceCsrGenerator %7B%0A%0A    private final String dnsSuffix;%0A%0A    public InstanceCsrGenerator(String dnsSuffix) %7B%0A        this.dnsSuffix = dnsSuffix;%0A    %7D%0A%0A    public Pkcs10Csr generateCsr(AthenzIdentity instanceIdentity,%0A                                 VespaUniqueInstanceId instanceId,%0A                                 Set%3CString%3E ipAddresses,%0A                                 KeyPair keyPair) %7B%0A        X500Principal subject = new X500Principal(%22CN=%22 + instanceIdentity.getFullName());%0A        // Add SAN dnsname %3Cservice%3E.%3Cdomain-with-dashes%3E.%3Cprovider-dnsname-suffix%3E%0A        // and SAN dnsname %3Cprovider-unique-instance-id%3E.instanceid.athenz.%3Cprovider-dnsname-suffix%3E%0A        Pkcs10CsrBuilder pkcs10CsrBuilder = Pkcs10CsrBuilder.fromKeypair(subject, keyPair, SignatureAlgorithm.SHA256_WITH_RSA)%0A                .addSubjectAlternativeName(%0A                        DNS_NAME,%0A                        String.format(%0A                                %22%25s.%25s.%25s%22,%0A                                instanceIdentity.getName(),%0A                                instanceIdentity.getDomainName().replace(%22.%22, %22-%22),%0A                                dnsSuffix))%0A                .addSubjectAlternativeName(DNS_NAME, String.format(%22%25s.instanceid.athenz.%25s%22, instanceId.asDottedString(), dnsSuffix));%0A        ipAddresses.forEach(ip -%3E  pkcs10CsrBuilder.addSubjectAlternativeName(new SubjectAlternativeName(IP_ADDRESS, ip)));%0A        return pkcs10CsrBuilder.build();%0A    %7D%0A%7D%0A

Add InstanceCsrGenerator