class KeyStoreCertSignerFactory implements CertSignerFactory {

    @Override
    public CertSigner create() {
        final String keyStorePassword = System.getProperty(ZTS_PROP_CERT_SIGNER_KEYSTORE_PASSWORD);
        final String keyStorePath = System.getProperty(ZTS_PROP_CERT_SIGNER_KEYSTORE_PATH);
        final String keyStoreType = System.getProperty(ZTS_PROP_CERT_SIGNER_KEYSTORE_TYPE, "PKCS12");
        final String caAlias = System.getProperty(ZTS_PROP_CERT_SIGNER_CA_ALIAS, "1");
        final int maxCertExpiryTimeMins = Integer.parseInt(System.getProperty(ZTSConsts.ZTS_PROP_CERTSIGN_MAX_EXPIRY_TIME, "43200"));

        // check null or empty
        if (keyStorePassword == null || keyStorePassword.isEmpty()) {
            throw CREATE_ILLEGAL_ARGUMENT_EXCEPTION.apply("keyStorePassword", ZTS_PROP_CERT_SIGNER_KEYSTORE_PASSWORD);
        }
        if (keyStorePath == null || keyStorePath.isEmpty()) {
            throw CREATE_ILLEGAL_ARGUMENT_EXCEPTION.apply("keyStorePath", ZTS_PROP_CERT_SIGNER_KEYSTORE_PATH);
        }

        try (FileInputStream fis = new FileInputStream(keyStorePath)) {
            // read ca certificate and key
            KeyStore ks = KeyStore.getInstance(keyStoreType);
            ks.load(fis, keyStorePassword.toCharArray());
            PrivateKey caPrivateKey = (PrivateKey) ks.getKey(caAlias, keyStorePassword.toCharArray());
            X509Certificate caCertificate = (X509Certificate) ks.getCertificate(caAlias);

            if (caPrivateKey == null || caCertificate == null) {
                throw CREATE_ILLEGAL_ARGUMENT_EXCEPTION.apply("caPrivateKey/caCertificate", ZTS_PROP_CERT_SIGNER_CA_ALIAS);
            }

            return new KeyStoreCertSigner(caCertificate, caPrivateKey, maxCertExpiryTimeMins);
        } catch (Exception ex) {
            throw new RuntimeException(ex);
        }
    }

}