class ZTSUtils {

    public static boolean verifyCertificateRequest(PKCS10CertificationRequest certReq,
            final String domain, final String service, X509CertRecord certRecord) {
        
        // verify that it contains the right common name
        // and the certificate matches to what we have
        // registered in ZMS

        final String cn = domain + "." + service;
        if (!validateCertReqCommonName(certReq, cn)) {
            LOGGER.error("validateCertificateRequest: unable to validate PKCS10 cert request common name");
            return false;
        }

        // verify we don't have invalid dnsnames in the csr
        
        if (!validateCertReqDNSNames(certReq, domain, service)) {
            LOGGER.error("validateCertificateRequest: unable to validate PKCS10 cert request DNS Name");
            return false;
        }
        
        // if we have an instance id then we have to make sure the
        // athenz instance id fields are identical
        
        if (certRecord != null) {
            
            // validate the service name matches first
            
            if (!cn.equals(certRecord.getService())) {
                LOGGER.error("verifyCertificateRequest: unable to validate cn: {} vs. cert record data: {}",
                        cn, certRecord.getService());
                return false;
            }
            
            // then validate instance ids
            
            if (!validateCertReqInstanceId(certReq, certRecord.getInstanceId())) {
                LOGGER.error("verifyCertificateRequest: unable to validate PKCS10 cert request instance id");
                return false;
            }
        }
        
        return true;
    }

}