class SpiffeSslContextFactory {

    public static SSLContext getSslContext(@NonNull final SslContextOptions options)
            throws NoSuchAlgorithmException, KeyManagementException {

        if (options.x509Source == null) {
            throw new IllegalArgumentException("x509Source option cannot be null, an X.509 Source must be provided");
        }

        if (!options.acceptAnySpiffeId && options.acceptedSpiffeIdsSupplier == null) {
            throw new IllegalArgumentException("SSL context should be configured either with a Supplier " +
                    "of accepted SPIFFE IDs or with acceptAnySpiffeId=true");
        }

        val sslContext = newSslContext(options);
        val trustManagers = newTrustManager(options);
        val keyManagers = new SpiffeKeyManagerFactory().engineGetKeyManagers(options.x509Source);

        sslContext.init(keyManagers, trustManagers, null);
        return sslContext;
    }

    private  SpiffeSslContextFactory();

}