ZTSImpl implements KeyStore, ZTSHandler { X509CertRecord getValidatedX509CertRecord(ResourceContext ctx, final String provider, final String instanceId, final String principalName, X509Certificate cert, final String caller, final String requestDomain, final String principalDomain, final String hostName) { X509CertRecord x509CertRecord = instanceCertManager.getX509CertRecord(provider, instanceId, principalName); if (x509CertRecord == null) { if (cert.getNotBefore().getTime() < x509CertRefreshResetTime) { x509CertRecord = insertX509CertRecord(ctx, principalName, provider, instanceId, cert.getSerialNumber().toString(), false, cert.getNotAfter(), hostName); } if (x509CertRecord == null) { throw forbiddenError("Unable to find certificate record", caller, requestDomain, principalDomain); } } if (!principalName.equals(x509CertRecord.getService())) { throw requestError("service name mismatch - csr: " + principalName + " cert db: " + x509CertRecord.getService(), caller, requestDomain, principalDomain); } String serialNumber = cert.getSerialNumber().toString(); if (x509CertRecord.getCurrentSerial().equals(serialNumber)) { x509CertRecord.setPrevIP(x509CertRecord.getCurrentIP()); x509CertRecord.setPrevTime(x509CertRecord.getCurrentTime()); x509CertRecord.setPrevSerial(x509CertRecord.getCurrentSerial()); } else if (!x509CertRecord.getPrevSerial().equals(serialNumber)) { if (cert.getNotBefore().getTime() > x509CertRefreshResetTime) { revokeCertificateRefresh(principalName, serialNumber, x509CertRecord); throw forbiddenError("Certificate revoked", caller, requestDomain, principalDomain); } } return x509CertRecord; } ZTSImpl();  ZTSImpl(CloudStore implCloudStore, DataStore implDataStore); @Override String getPublicKey(String domain, String service, String keyId); ServiceIdentity getServiceIdentity(ResourceContext ctx, String domainName, String serviceName); PublicKeyEntry getPublicKeyEntry(ResourceContext ctx, String domainName,
            String serviceName, String keyId); ServiceIdentityList getServiceIdentityList(ResourceContext ctx, String domainName); HostServices getHostServices(ResourceContext ctx, String host); Response getDomainSignedPolicyData(ResourceContext ctx, String domainName, String matchingTag); TenantDomains getTenantDomains(ResourceContext ctx, String providerDomainName,
            String userName, String roleName, String serviceName); @Override RoleToken getRoleToken(ResourceContext ctx, String domainName, String roleNames,
            Integer minExpiryTime, Integer maxExpiryTime, String proxyForPrincipal); @Override AccessTokenResponse postAccessTokenRequest(ResourceContext ctx, String request); RoleAccess getRoleAccess(ResourceContext ctx, String domainName, String principal); @Override RoleToken postRoleCertificateRequest(ResourceContext ctx, String domainName,
            String roleName, RoleCertificateRequest req); @Override RoleCertificate postRoleCertificateRequestExt(ResourceContext ctx, RoleCertificateRequest req); AWSTemporaryCredentials getAWSTemporaryCredentials(ResourceContext ctx, String domainName,
            String roleName, Integer durationSeconds, String externalId); @Override Response postInstanceRegisterInformation(ResourceContext ctx, InstanceRegisterInformation info); @Override InstanceIdentity postInstanceRefreshInformation(ResourceContext ctx, String provider,
            String domain, String service, String instanceId, InstanceRefreshInformation info); @Override void deleteInstanceIdentity(ResourceContext ctx, String provider,
            String domain, String service, String instanceId); @Deprecated @Override Identity postInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, InstanceRefreshRequest req); @Override Response postSSHCertRequest(ResourceContext ctx, SSHCertRequest certRequest); @Override JWKList getJWKList(ResourceContext ctx, Boolean rfc); @Deprecated @Override Identity postOSTKInstanceRefreshRequest(ResourceContext ctx, String domain,
            String service, OSTKInstanceRefreshRequest req); @Override ResourceAccess getResourceAccessExt(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override ResourceAccess getResourceAccess(ResourceContext ctx, String action, String resource,
            String trustDomain, String checkPrincipal); @Override Access getAccess(ResourceContext ctx, String domainName, String roleName,
            String principal); CertificateAuthorityBundle getCertificateAuthorityBundle(ResourceContext ctx, String name); @Override DomainMetrics postDomainMetrics(ResourceContext ctx, String domainName,
            DomainMetrics domainMetrics); @Override Status getStatus(ResourceContext ctx); @Override Schema getRdlSchema(ResourceContext context); ResourceContext newResourceContext(HttpServletRequest request,
                                              HttpServletResponse response,
                                              String apiName); static String getRootDir(); void recordMetrics(ResourceContext ctx, int httpStatus);  }
@Test public void testGetValidatedX509CertRecord() throws IOException { ChangeLogStore structStore = new ZMSFileChangeLogStore("/tmp/zts_server_unit_tests/zts_root", privateKey, "0"); DataStore store = new DataStore(structStore, null); ZTSImpl ztsImpl = new ZTSImpl(mockCloudStore, store); SignedDomain providerDomain = signedAuthorizedProviderDomain(); store.processDomain(providerDomain, false); SignedDomain tenantDomain = signedBootstrapTenantDomain("athenz.provider", "athenz", "production"); store.processDomain(tenantDomain, false); InstanceCertManager instanceCertManager = Mockito.mock(InstanceCertManager.class); Mockito.when(instanceCertManager.getX509CertRecord("athenz.provider", "1001", "athenz.production")) .thenReturn(null); Mockito.when(instanceCertManager.insertX509CertRecord(Mockito.any())).thenReturn(true); ztsImpl.instanceCertManager = instanceCertManager; Path path = Paths.get("src/test/resources/athenz.instanceid.pem"); String pem = new String(Files.readAllBytes(path)); X509Certificate cert = Crypto.loadX509Certificate(pem); CertificateAuthority certAuthority = new CertificateAuthority(); SimplePrincipal principal = (SimplePrincipal) SimplePrincipal.create("athenz", "production", "v=S1;d=athenz;n=production;s=signature", 0, certAuthority); ResourceContext context = createResourceContext(principal); ztsImpl.x509CertRefreshResetTime = cert.getNotBefore().getTime() + 1; X509CertRecord certRecord = ztsImpl.getValidatedX509CertRecord(context, "athenz.provider", "1001", "athenz.production", cert, "caller", "athenz", "athenz", "localhost"); assertNotNull(certRecord); }