@Test
public void testPostInstanceRefreshRequestByServiceCertValidateFail() throws IOException {

    ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root",
            privateKey, "0");
    
    DataStore store = new DataStore(structStore, null);
    ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store);
    
    Path path = Paths.get("src/test/resources/valid_provider_refresh.csr");
    String certCsr = new String(Files.readAllBytes(path));
    InstanceRefreshRequest req = new InstanceRefreshRequest().setCsr(certCsr)
            .setKeyId("v0");
    path = Paths.get("src/test/resources/athenz.instanceid.pem");
    String pem = new String(Files.readAllBytes(path));
    X509Certificate cert = Crypto.loadX509Certificate(pem);
    
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz",
            "syncer", "v=S1,d=athenz;n=syncer;s=sig", 0, new CertificateAuthority());
    principal.setX509Certificate(cert);
    
    String publicKeyName = "athenz.syncer_v0";
    final String ztsPublicKey = "-----BEGIN PUBLIC KEY-----\n"
            + "MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAMp9ZHVDK2s/FyinpKpD7lSsU+d6TSRE\n"
            + "NVo6sdLrEpOaCJETsh+0Qc0knhALxBD1+B9gS5F2rAFgtug0R6savvMCAwEAAQ==\n"
            + "-----END PUBLIC KEY-----";
    ztsImpl.dataStore.getPublicKeyCache().put(publicKeyName, ztsPublicKey);
    ZTSAuthorizer authorizer = Mockito.mock(ZTSAuthorizer.class);
    Mockito.when(authorizer.access("update", "athenz:service", principal, null)).thenReturn(true);
    ztsImpl.authorizer = authorizer;
    
    HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class);
    Mockito.when(servletRequest.isSecure()).thenReturn(true);
    ResourceContext context = createResourceContext(principal, servletRequest);
    try {
        ztsImpl.postInstanceRefreshRequest(context, "athenz", "syncer", req);
        fail();
    } catch (ResourceException ex) {
        assertTrue(ex.getMessage().contains("DNS_NAME_MISMATCH"), ex.getMessage());
    }
}