@@ -0,0 +1,1535 @@
+// Copyright Verizon Media. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.%0Apackage com.yahoo.vespa.athenz.client.zts.utils;%0A%0Aimport com.yahoo.security.Pkcs10Csr;%0Aimport com.yahoo.security.Pkcs10CsrBuilder;%0Aimport com.yahoo.security.SubjectAlternativeName.Type;%0Aimport com.yahoo.vespa.athenz.api.AthenzIdentity;%0Aimport com.yahoo.vespa.athenz.api.AthenzRole;%0Aimport com.yahoo.vespa.athenz.client.zts.ZtsClient;%0A%0Aimport javax.security.auth.x500.X500Principal;%0Aimport java.security.KeyPair;%0A%0Aimport static com.yahoo.security.SignatureAlgorithm.SHA256_WITH_RSA;%0A%0A/**%0A * Generates a %7B@link Pkcs10Csr%7D instance for use with %7B@link ZtsClient#getRoleCertificate(AthenzRole, Pkcs10Csr)%7D.%0A *%0A * @author bjorncs%0A */%0Apublic class RoleCsrGenerator %7B%0A%0A    private final String dnsSuffix;%0A%0A    public RoleCsrGenerator(String dnsSuffix) %7B%0A        this.dnsSuffix = dnsSuffix;%0A    %7D%0A%0A    public Pkcs10Csr generateCsr(AthenzIdentity identity, AthenzRole role, KeyPair keyPair) %7B%0A        return Pkcs10CsrBuilder.fromKeypair(new X500Principal(%22CN=%22 + role.toResourceNameString()), keyPair, SHA256_WITH_RSA)%0A                .addSubjectAlternativeName(%0A                        Type.DNS_NAME,%0A                        String.format(%22%25s.%25s.%25s%22, identity.getName(), identity.getDomainName().replace(%22.%22, %22-%22), dnsSuffix))%0A                .addSubjectAlternativeName(%0A                        Type.RFC822_NAME,%0A                        String.format(%22%25s@%25s%22, identity.getFullName(), dnsSuffix))%0A                .build();%0A    %7D%0A%7D%0A

Add CSR generator for role certificates