class InstanceUtils {

    public static boolean validateCertRequestSanDnsNames(final Map<String, String> attributes,
                                                         final String domain, final String service, final String dnsSuffix,
                                                         StringBuilder instanceId) {

        // make sure we have valid dns suffix specified

        if (dnsSuffix == null || dnsSuffix.isEmpty()) {
            LOGGER.error("No AWS DNS suffix specified for validation");
            return false;
        }

        // first check to see if we're given any san dns names to validate
        // if the list is empty then something is not right thus we'll
        // reject the request

        final String hostnames = InstanceUtils.getInstanceProperty(attributes, InstanceProvider.ZTS_INSTANCE_SAN_DNS);
        if (hostnames == null || hostnames.isEmpty()) {
            LOGGER.error("Request contains no SAN DNS entries for validation");
            return false;
        }

        // generate the expected hostname for check

        final String hostNameCheck = service + "." + domain.replace('.', '-') + "." + dnsSuffix;

        // validate the entries

        boolean hostCheck = false;
        boolean instanceIdCheck = false;

        String[] hosts = hostnames.split(",");

        // we only allow up to two hostnames in our AWS CSR:
        // service.<domain-with-dashes>.<dns-suffix>
        // <instance-id>.instanceid.athenz.<dns-suffix>
        // instance id can be specified as URI

        if (hosts.length > 2) {
            LOGGER.error("Request does not contain expected number of SAN DNS entries: {}",
                    hosts.length);
            return false;
        }

        for (String host : hosts) {

            int idx = host.indexOf(ZTS_CERT_INSTANCE_ID);
            if (idx != -1) {
                instanceId.append(host, 0, idx);
                if (!dnsSuffix.equals(host.substring(idx + ZTS_CERT_INSTANCE_ID.length()))) {
                    LOGGER.error("Host: {} does not have expected instance id format", host);
                    return false;
                }

                instanceIdCheck = true;
            } else {
                if (!hostNameCheck.equals(host)) {
                    LOGGER.error("Unable to verify SAN DNS entry: {}", host);
                    return false;
                }
                hostCheck = true;
            }
        }

        // if we have no host entry that it's a failure

        if (!hostCheck) {
            LOGGER.error("Request does not contain expected host SAN DNS entry");
            return false;
        }

        // if there is no instance id field in dnsName check to
        // see if it was passed in the uri as expected

        if (!instanceIdCheck && !validateCertRequestUriId(attributes, instanceId)) {
            LOGGER.error("Request does not contain expected instance id entry");
            return false;
        }

        return true;
    }

}