@Test
public void testCreateChildKeyStore() throws Exception {

  ProxyCA proxyCA = new ProxyCA();
  proxyCA.init();
  ApplicationId appId =
      ApplicationId.newInstance(System.currentTimeMillis(), 1);
  byte[] keystoreBytes = proxyCA.createChildKeyStore(appId,
      "password");
  KeyStore keyStore = KeyStoreTestUtil.bytesToKeyStore(keystoreBytes,
      "password");
  Assert.assertEquals(1, keyStore.size());
  Certificate[] certChain = keyStore.getCertificateChain("server");
  Assert.assertEquals(2, certChain.length);
  X509Certificate caCert = (X509Certificate) certChain[1];
  X509Certificate cert = (X509Certificate) certChain[0];
  // check child cert
  Assert.assertEquals(caCert.getSubjectX500Principal().toString(),
      cert.getIssuerDN().toString());
  Assert.assertEquals(new X500Principal("CN=" + appId),
      cert.getSubjectX500Principal());
  Assert.assertFalse("Found multiple fields in X500 Principal, when there " +
          "should have only been one: " + cert.getSubjectX500Principal(),
      cert.getSubjectX500Principal().toString().contains(","));
  Assert.assertEquals("SHA512withRSA", cert.getSigAlgName());
  Assert.assertEquals(cert.getNotBefore(), cert.getNotAfter());
  Assert.assertTrue("Expected certificate to be expired but was not: "
      + cert.getNotAfter(), cert.getNotAfter().before(new Date()));
  Assert.assertEquals(new X500Principal("CN=" + appId).toString(),
      cert.getSubjectDN().toString());
  Key privateKey = keyStore.getKey("server", "password".toCharArray());
  Assert.assertEquals("RSA", privateKey.getAlgorithm());
  Assert.assertEquals(-1, cert.getBasicConstraints());
  // verify signature on child cert
  PublicKey caPublicKey = caCert.getPublicKey();
  cert.verify(caPublicKey);
  // check CA cert
  checkCACert(caCert);
  Assert.assertEquals(proxyCA.getCaCert(), caCert);
  // verify signature on CA cert
  caCert.verify(caPublicKey);
  // verify CA public key matches private key
  PrivateKey caPrivateKey =
      proxyCA.getX509KeyManager().getPrivateKey(null);
  checkPrivatePublicKeys(caPrivateKey, caPublicKey);
  Assert.assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
  Assert.assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
}