class X509CertRequest {

    public boolean validateDnsNames(final String domainName, final String serviceName, final String provider,
            final DataCache athenzSysDomainCache, final String serviceDnsSuffix, final String instanceHostname,
            final List<String> instanceHostCnames, HostnameResolver hostnameResolver) {

        // if the CSR has no dns names then we have nothing to check

        if (dnsNames.isEmpty()) {
            return true;
        }

        // if we're given an instance host and cname fields then we're going to validate
        // to make sure it's correct for the given request. Any invalid host/cname field
        // value will cause the request to be rejected

        if (!validateInstanceHostname(provider, athenzSysDomainCache, instanceHostname, hostnameResolver)) {
            LOGGER.error("Unable to validate Instance hostname: {}", instanceHostname);
            return false;
        }

        if (!validateInstanceCnames(provider, athenzSysDomainCache, domainName + "." + serviceName,
                instanceHostname, instanceHostCnames, hostnameResolver)) {
            return false;
        }

        // make sure our provider dns list is empty

        providerDnsNames.clear();

        // verify that our dns name suffixes match before returning success
        // if we have a match with our provider dns suffix then we're going
        // to keep track of those entries in a separate list so we can
        // send them to the provider for verification (provider does not
        // have knowledge about the additional service dns domain entries
        // so it doesn't need to get those). We also support the case of
        // wildcard based on the service name in the format of:
        // *.<service>.<domain-with-dashes>.<provider-dns-suffix>
        // so we'll generate and pass the prefix to the function to verify
        // and automatically skip those from sending to the provider

        final String wildCardPrefix = "*." + serviceName + "." + domainName.replace('.', '-') + ".";
        final String serviceDnsSuffixCheck = (serviceDnsSuffix != null) ? "." + serviceDnsSuffix : null;

        final List<String> providerDnsSuffixList = athenzSysDomainCache.getProviderDnsSuffixList(provider);

        for (String dnsName : dnsNames) {
            if (!dnsSuffixCheck(dnsName, providerDnsSuffixList, serviceDnsSuffixCheck, wildCardPrefix,
                    instanceHostname, instanceHostCnames)) {
                return false;
            }
        }

        return true;
    }

    public  X509CertRequest(String csr);

}