@Test
public void testValidateRoleCertificateRequestWithUriHostname() throws IOException {

    Path path = Paths.get("src/test/resources/athenz.examples.role-uri-hostname-only.csr");
    String csr = new String(Files.readAllBytes(path));
    path = Paths.get("src/test/resources/athenz.examples.no-uri.pem");
    String pem = new String(Files.readAllBytes(path));
    X509Certificate cert = Crypto.loadX509Certificate(pem);
    Set<String> roles = new HashSet<>();
    roles.add("readers");
    // if the CSR has hostname, but the cert doesn't have hostname, it should result in false
    assertFalse(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd",
            null, cert, "10.0.0.1"));
    path = Paths.get("src/test/resources/athenz.examples.uri-hostname-only.pem");
    pem = new String(Files.readAllBytes(path));
    cert = Crypto.loadX509Certificate(pem);
    assertTrue(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd",
            null, cert, "10.0.0.1"));
    path = Paths.get("src/test/resources/athenz.examples.role-uri-instanceid-hostname.csr");
    csr = new String(Files.readAllBytes(path));
    // if CSR has hostname+instanceid, and cert has only hostname, it should result in false
    // Todo: ignoring instanceid mismatches. in later iterations, this will be a failure
    assertTrue(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd",
            null, cert, "10.0.0.1"));
    path = Paths.get("src/test/resources/athenz.examples.uri-instanceid-hostname.pem");
    pem = new String(Files.readAllBytes(path));
    cert = Crypto.loadX509Certificate(pem);
    assertTrue(zts.validateRoleCertificateRequest(csr, "athenz.examples", roles, "athenz.examples.httpd",
            null, cert, "10.0.0.1"));
}