class InstanceCertManager {

    void updateSSHHostPrincipals(SshHostCsr sshHostCsr, SSHCertRecord sshCertRecord) {

        if (sshHostCsr == null) {
            sshCertRecord.setPrincipals("127.0.0.1");
            return;
        }

        String recordPrincipals = "";

        // check both principals and x-principal fields

        String[] principals = sshHostCsr.getPrincipals();
        String[] xprincipals = sshHostCsr.getXPrincipals();
        if (principals != null || xprincipals != null) {
            Set<String> principalSet = new HashSet<>();
            if (principals != null) {
                principalSet.addAll(Arrays.asList(principals));
            }
            if (xprincipals != null) {
                principalSet.addAll(Arrays.asList(xprincipals));
            }
            if (!principalSet.isEmpty()) {
                recordPrincipals = String.join(",", principalSet);
            }
        }

        if (recordPrincipals.isEmpty()) {
            sshCertRecord.setPrincipals("127.0.0.1");
        } else {
            sshCertRecord.setPrincipals(recordPrincipals);
        }
    }

    public  InstanceCertManager(final PrivateKeyStore keyStore, Authorizer authorizer, HostnameResolver hostnameResolver,
            boolean readOnlyMode);

}