class InstanceCertManager {

    public SSHCertificates generateSSHCertificates(Principal principal, SSHCertRequest certRequest) {

        if (sshSigner == null) {
            LOGGER.error("SSH Signer is not available");
            return null;
        }

        // if this is a host certificate we're going to fetch our
        // ssh certificate record

        SSHCertRecord sshCertRecord = null;
        SSHCertRequestMeta meta = certRequest.getCertRequestMeta();
        if (ZTSConsts.ZTS_SSH_HOST.equals(meta.getCertType())) {
            sshCertRecord = getSSHCertRecord(meta.getInstanceId(), meta.getAthenzService());
        }

        // ssh signer is responsible for all authorization checks and processing
        // of this request. the signer already was given the authorizer object
        // that it can use for those checks.

        return sshSigner.generateCertificate(principal, certRequest, sshCertRecord, null);
    }

    public  InstanceCertManager(final PrivateKeyStore keyStore, Authorizer authorizer, HostnameResolver hostnameResolver,
            boolean readOnlyMode);

}