@Test
public void testPostOSTKInstanceRefreshRequestSerialMisMatch() throws IOException {

    Path path = Paths.get("src/test/resources/athenz.instanceid.csr");
    String certCsr = new String(Files.readAllBytes(path));
    OSTKInstanceRefreshRequest req = new OSTKInstanceRefreshRequest().setCsr(certCsr);
    SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create(
            "athenz",
            "production",
            "v=S1,d=athenz;n=production;s=sig",
            0,
            new CertificateAuthority()
    );
    HttpServletRequest servletRequest = Mockito.mock(HttpServletRequest.class);
    Mockito.when(servletRequest.isSecure()).thenReturn(true);
    
    path = Paths.get("src/test/resources/athenz.instanceid.pem");
    String pem = new String(Files.readAllBytes(path));
    X509Certificate cert = Crypto.loadX509Certificate(pem);
    principal.setX509Certificate(cert);
    
    ResourceContext context = createResourceContext(principal, servletRequest);
    X509CertRecord certRecord = new X509CertRecord();
    certRecord.setService("athenz.production");
    certRecord.setProvider("ostk");
    certRecord.setInstanceId("1001");
    certRecord.setCurrentSerial("12341324334");
    certRecord.setPrevSerial("2342134323");
    
    CertRecordStore certStore = Mockito.mock(CertRecordStore.class);
    CertRecordStoreConnection certConnection = Mockito.mock(CertRecordStoreConnection.class);
    Mockito.when(certStore.getConnection()).thenReturn(certConnection);
    Mockito.when(certConnection.getX509CertRecord("ostk", "1001", "athenz.production")).thenReturn(certRecord);
    Mockito.when(certConnection.updateX509CertRecord(ArgumentMatchers.isA(X509CertRecord.class))).thenReturn(true);
    zts.instanceCertManager.setCertStore(certStore);
    
    try {
        zts.postOSTKInstanceRefreshRequest(context, "athenz", "production", req);
        fail();
    } catch (ResourceException ex) {
        assertEquals(ex.getCode(), 403);
        assertTrue(ex.getMessage().contains("Certificate revoked"));
    }
}