@Test
public void testValidateInstanceCnames() throws IOException {

    Path path = Paths.get("src/test/resources/athenz.instanceid.uri.csr");
    String csr = new String(Files.readAllBytes(path));
    String service = "athenz.api";
    X509CertRequest certReq = new X509CertRequest(csr);
    assertNotNull(certReq);
    // cnames null and empty is always true
    assertTrue(certReq.validateInstanceCnames(null, null, service, null, null, null));
    assertTrue(certReq.validateInstanceCnames(null, null, service, null, Collections.emptyList(), null));
    // if the name is empty or null, then it's failure
    assertFalse(certReq.validateInstanceCnames(null, null, service, null,
            Collections.singletonList("host1.athenz.cloud"), null));
    assertFalse(certReq.validateInstanceCnames(null, null, service, "",
            Collections.singletonList("host1.athenz.cloud"), null));
    DataCache athenzSysDomainCache = Mockito.mock(DataCache.class);
    List<String> providerHostnameAllowedSuffixList = Collections.singletonList("athenz.cloud");
    Mockito.when(athenzSysDomainCache.getProviderHostnameAllowedSuffixList("provider"))
            .thenReturn(providerHostnameAllowedSuffixList);
    List<String> providerHostnameDeniedSuffixList = Collections.singletonList("athenz.info");
    Mockito.when(athenzSysDomainCache.getProviderHostnameDeniedSuffixList("provider"))
            .thenReturn(providerHostnameDeniedSuffixList);
    // cname does not match allowed suffix list thus denied
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud",
            Collections.singletonList("host1.athenz.data"), null));
    List<String> cnameList = new ArrayList<>();
    cnameList.add("host1.athenz.cloud");
    cnameList.add("host1.athenz.data");
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud",
            cnameList, null));
    // cname is explicitly denied
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud",
            Collections.singletonList("host1.athenz.info"), null));
    cnameList.add("host1.athenz.info");
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud",
            cnameList, null));
    // no hostname resolver thus denied
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud",
            Collections.singletonList("host1.athenz.cloud"), null));
    HostnameResolver resolver = Mockito.mock(HostnameResolver.class);
    Mockito.when(resolver.isValidHostCnameList(service, "hostname.athenz.cloud", Collections.singletonList("host1.athenz.cloud"), CertType.X509))
            .thenReturn(false);
    assertFalse(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud",
            Collections.singletonList("host1.athenz.cloud"), resolver));
    // set resolver to return true for host2
    Mockito.when(resolver.isValidHostCnameList(service, "hostname.athenz.cloud", Collections.singletonList("host2.athenz.cloud"), CertType.X509))
            .thenReturn(true);
    assertTrue(certReq.validateInstanceCnames("provider", athenzSysDomainCache, service, "hostname.athenz.cloud",
            Collections.singletonList("host2.athenz.cloud"), resolver));
}