class X509ServiceCertRequest extends X509CertRequest {

    public boolean validate(final String domainName, final String serviceName, final String provider,
            final Set<String> validSubjectOValues, final DataCache athenzSysDomainCache,
            final String serviceDnsSuffix, final String instanceHostname, final List<String> instanceHostCnames,
            HostnameResolver hostnameResolver, StringBuilder errorMsg) {

        // instanceId must be non empty

        if (instanceId == null || instanceId.isEmpty()) {
            errorMsg.append("InstanceId cannot be empty");
            return false;
        }

        // validate the common name in CSR and make sure it
        // matches to the values specified in the info object

        final String infoCommonName = domainName + "." + serviceName;
        if (!validateCommonName(infoCommonName)) {
            errorMsg.append("Unable to validate CSR common name");
            return false;
        }

        // ensure the uri Hostname is same as instance Hostname that gets further verified later

        if (!validateUriHostname(instanceHostname)) {
            errorMsg.append("Instance/Uri hostname mismatch: ").append(instanceHostname)
                .append(" vs. ").append(uriHostname);
            return false;
        }

        // validate that the dnsSuffix used in the dnsName attribute has
        // been authorized to be used by the given provider

        if (!validateDnsNames(domainName, serviceName, provider, athenzSysDomainCache, serviceDnsSuffix,
                instanceHostname, instanceHostCnames, hostnameResolver)) {
            errorMsg.append("Unable to validate CSR SAN dnsNames - invalid dns suffix");
            return false;
        }

        // validate the O field in the certificate if necessary

        if (!validateSubjectOField(validSubjectOValues)) {
            errorMsg.append("Unable to validate Subject O Field");
            return false;
        }

        // validate spiffe uri if one is provided

        if (!validateSpiffeURI(domainName, "sa", serviceName)) {
            errorMsg.append("Unable to validate Service SPIFFE URI");
            return false;
        }

        return true;
    }

    public  X509ServiceCertRequest(String csr);

}