@Test
public void testValidateDnsNamesHostnameNotAllowed() throws IOException {

    Path path = Paths.get("src/test/resources/multi_dns_domain.csr");
    String csr = new String(Files.readAllBytes(path));
    X509CertRequest certReq = new X509CertRequest(csr);
    assertNotNull(certReq);
    List<String> providerDnsSuffixList = new ArrayList<>();
    providerDnsSuffixList.add("ostk.athenz.cloud");
    DataCache athenzSysDomainCache = Mockito.mock(DataCache.class);
    Mockito.when(athenzSysDomainCache.getProviderDnsSuffixList("provider"))
            .thenReturn(providerDnsSuffixList);
    // first we're going to allow a suffix that does not match
    // to our list
    List<String> providerHostnameAllowedSuffixList = new ArrayList<>();
    providerHostnameAllowedSuffixList.add(".ostk.athenz.data");
    Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider"))
            .thenReturn(providerHostnameAllowedSuffixList);
    assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache,
            "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null));
    // next we're going to add the suffix that matches so we'll get
    // successful response
    providerHostnameAllowedSuffixList.add(".ostk.athenz.info");
    assertTrue(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache,
            "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null));
    // now we're going to return a denied list but first a value that
    // does not match our hostname
    List<String> providerHostnameDeniedSuffixList = new ArrayList<>();
    providerHostnameDeniedSuffixList.add(".ostk.athenz.data");
    Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider"))
            .thenReturn(providerHostnameDeniedSuffixList);
    // since there is no match in our denied list we're going to get
    // a still successful response
    assertTrue(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache,
            "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null));
    // now we're going to add the suffix to the list and make sure the
    // request is denied
    providerHostnameDeniedSuffixList.add(".ostk.athenz.info");
    assertFalse(certReq.validateDnsNames("athenz", "api", "provider", athenzSysDomainCache,
            "zts.athenz.info", "api.athenz.ostk.athenz.info", null, null));
}