class AthenzUtils {

    public static String extractServicePrincipal(X509Certificate x509Cert) {

        // let's first get the common name of the certificate

        String principal = Crypto.extractX509CertCommonName(x509Cert);
        if (principal == null) {
            return null;
        }

        // check to see if we're dealing with role certificate which
        // has the <domain>:role.<rolename> format or service
        // certificate which has the <domain>.<service> format

        if (principal.contains(AuthorityConsts.ROLE_SEP)) {

            // it's a role certificate so we're going to extract
            // our service principal from the SAN email field
            // verify that we must have only a single email
            // field in the certificate

            final List<String> emails = Crypto.extractX509CertEmails(x509Cert);
            if (emails.size() != 1) {
                return null;
            }

            // athenz always verifies that we include a valid
            // email in the certificate

            final String email = emails.get(0);
            int idx = email.indexOf('@');
            if (idx == -1) {
                return null;
            }

            principal = email.substring(0, idx);
        }

        return principal;
    }

    private  AthenzUtils();

}