class X509CertUtils {

    public static String extractRequestInstanceId(X509Certificate cert) {

        if (cert == null) {
            return null;
        }

        // first we're going to look for our uri field to see
        // if we have an instance id uri available. the format is:
        // athenz://instanceid/<provider>/<instance-id>

        final List<String> uriList = Crypto.extractX509CertURIs(cert);
        final String instanceId = extractRequestInstanceIdFromURI(uriList);
        if (instanceId != null) {
            return instanceId;
        }

        // if no uri, then we'll fall back to our old dnsName field

        final List<String> dnsNames = Crypto.extractX509CertDnsNames(cert);
        return extractRequestInstanceIdFromDnsNames(dnsNames);
    }

}