class ZTSUtils {

    static boolean validateCertReqDNSNames(PKCS10CertificationRequest certReq, final String domain,
            final String service) {
        
        // if no dns names in the CSR then we're ok
        
        List<String> dnsNames = Crypto.extractX509CSRDnsNames(certReq);
        if (dnsNames.isEmpty()) {
            return true;
        }
        
        // the only two formats we're allowed to have in the CSR are:
        // 1) <service>.<domain-with-dashes>.<provider-dns-suffix>
        // 2) <service>.<domain-with-dashes>.instanceid.athenz.<provider-dns-suffix>
        
        final String prefix = service + "." + domain.replace('.', '-') + ".";
        for (String dnsName : dnsNames) {
            if (dnsName.startsWith(prefix) && dnsName.endsWith(ZTS_CERT_DNS_SUFFIX)) {
                continue;
            }
            if (dnsName.contains(ZTSConsts.ZTS_CERT_INSTANCE_ID_DNS)) {
                continue;
            }
            LOGGER.error("validateServiceCertReqDNSNames - Invalid dnsName SAN entry: {}", dnsName);
            return false;
        }

        return true;
    }

}