@Test public void ignoresMultipleUris() throws Exception {

  CertificateFactory cf = CertificateFactory.getInstance("X.509");
  X509Certificate multipleUriClientCert = (X509Certificate) cf.generateCertificate(
      new ByteArrayInputStream(multipleUriPem.getBytes(UTF_8)));
  Principal multipleUriPrincipal =
      new CertificatePrincipal(multipleUriClientCert.getSubjectDN().toString(),
          new X509Certificate[] {multipleUriClientCert});
  // Use only the (malformatted) URIs to retrieve a client (which should fail)
  when(clientAuthTypeConfig.useCommonName()).thenReturn(false);
  when(clientAuthTypeConfig.useSpiffeId()).thenReturn(true);
  assertThat(authenticator.authenticate(multipleUriPrincipal, false)).isEmpty();
  verifyNoInteractions(clientDAO);
}