class ZTSImpl implements KeyStore, ZTSHandler {

    boolean validateRoleCertificateRequest(final String csr, final String domainName,
            Set<String> roles, final String principal, final String proxyUser, X509Certificate cert,
            final String ip) {

        X509RoleCertRequest certReq;
        try {
            certReq = new X509RoleCertRequest(csr);
        } catch (CryptoException ex) {
            LOGGER.error("unable to parse PKCS10 CSR: " + ex.getMessage());
            return false;
        }

        if (!certReq.validate(roles, domainName, principal, proxyUser, validCertSubjectOrgValues)) {
            return false;
        }

        // validate the role cert has the correct subject ou

        if (!validateRoleCertSubjectOU(certReq, cert)) {
            return false;
        }

        // validate uriHostname in request matches the uriHostname in cert
        if (!validateUriHostname(certReq.getUriHostname(), cert)) {
            return false;
        }

        // validate InstanceID in request matches the instanceid in the cert
        if (!validateInstanceId(certReq.getInstanceId(), cert)) {
            // Todo: minitor the logs, and make this a hard failure in later iteration
            LOGGER.error("unable to match request id: {} with cert id: {}", certReq.getInstanceId(), X509CertUtils.extractRequestInstanceId(cert));
        }

        // validate the ip address if any provided

        return verifyCertRequestIP ? certReq.validateIPAddress(cert, ip) : true;
    }

    public  ZTSImpl();
    public  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore);

}