@Test
public void testIsRestrictedCertificateMultipleValues() throws Exception {

    System.setProperty("athenz.crypto.restricted_ou", "restricted.ou.1, regular.ou");
    GlobStringsMatcher globStringsMatcher = new GlobStringsMatcher(ATHENZ_PROP_RESTRICTED_OU);
    try {
        // restricted_ou_1 should match
        try (InputStream inStream = new FileInputStream("src/test/resources/ou_tests/restricted_ou_1.pem")) {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            X509Certificate cert = (X509Certificate) cf.generateCertificate(inStream);
            boolean restrictedCertificate = Crypto.isRestrictedCertificate(cert, globStringsMatcher);
            assertTrue(restrictedCertificate);
        }
        // The others that begin with "restricted_ou" shouldn't
        try (InputStream inStream = new FileInputStream("src/test/resources/ou_tests/restricted_ou_2.pem")) {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            X509Certificate cert = (X509Certificate) cf.generateCertificate(inStream);
            boolean restrictedCertificate = Crypto.isRestrictedCertificate(cert, globStringsMatcher);
            assertFalse(restrictedCertificate);
        }
        try (InputStream inStream = new FileInputStream("src/test/resources/ou_tests/restricted_ou_3.pem")) {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            X509Certificate cert = (X509Certificate) cf.generateCertificate(inStream);
            boolean restrictedCertificate = Crypto.isRestrictedCertificate(cert, globStringsMatcher);
            assertFalse(restrictedCertificate);
        }
        // regular_ou should match
        try (InputStream inStream = new FileInputStream("src/test/resources/ou_tests/regular_ou.pem")) {
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            X509Certificate cert = (X509Certificate) cf.generateCertificate(inStream);
            boolean restrictedCertificate = Crypto.isRestrictedCertificate(cert, globStringsMatcher);
            assertTrue(restrictedCertificate);
        }
    } finally {
        System.clearProperty("athenz.crypto.restricted_ou");
    }
}