@Test
public void should_validate_child_ca() {

    KeyPair childKeyPair = KEY_PAIR_FACTORY.generate();
    TrustAnchor ta = wtx(tx -> factory.createTrustAnchor(tx, x -> {
        TrustAnchorsFactory.CertificateAuthority child = TrustAnchorsFactory.CertificateAuthority.builder()
            .dn("CN=child-ca")
            .keyPair(childKeyPair)
            .certificateLocation(TA_CA_REPOSITORY_URI + "CN=child-ca.cer")
            .resources(IpResourceSet.parse("192.168.128.0/17"))
            .notifyURI(TA_RRDP_NOTIFY_URI)
            .manifestURI("rsync://rpki.test/CN=child-ca/child-ca.mft")
            .repositoryURI("rsync://rpki.test/CN=child-ca/")
            .crlDistributionPoint("rsync://rpki.test/CN=child-ca/child-ca.crl")
            .build();
        x.children(Arrays.asList(child));
    }));
    wtx0(tx -> {
        this.getTrustAnchors().add(tx, ta);
        final Ref<TrustAnchor> trustAnchorRef = this.getTrustAnchors().makeRef(tx, ta.key());
        RpkiRepository repository = this.getRpkiRepositories().register(tx, trustAnchorRef, TA_RRDP_NOTIFY_URI, RpkiRepository.Type.RRDP);
        repository.setDownloaded();
        this.getRpkiRepositories().update(tx, repository);
    });
    subject.validate(ta.key().asLong());
    List<CertificateTreeValidationRun> completed = rtx(tx -> this.getValidationRuns().findAll(tx, CertificateTreeValidationRun.class));
    assertThat(completed).hasSize(1);
    rtx0(tx -> {
        final Optional<TrustAnchor> trustAnchor = this.getTrustAnchors().get(tx, ta.key());
        assertThat(trustAnchor.get().isInitialCertificateTreeValidationRunCompleted()).as("trust anchor initial validation run completed").isTrue();
        assertThat(this.getSettings().isInitialValidationRunCompleted(tx)).as("validator initial validation run completed").isTrue();
    });
    List<Pair<CertificateTreeValidationRun, RpkiObject>> validated = rtx(tx ->
            this.getValidationRuns().findCurrentlyValidated(tx, RpkiObject.Type.CER).collect(toList()));
    assertThat(validated).hasSize(1);
    assertThat(validated.get(0).getLeft()).isEqualTo(completed.get(0));
    Optional<X509ResourceCertificate> cro = validated.get(0).getRight().get(X509ResourceCertificate.class, ValidationResult.withLocation("ignored.cer"));
    assertThat(cro).isPresent().hasValueSatisfying(x -> assertThat(x.getSubject()).isEqualTo(new X500Principal("CN=child-ca")));
}