if (Configuration.DEBUG)
  protected byte[] getSelfSignedCertificate(X500DistinguishedName distinguishedName,                                            PublicKey publicKey,                                            PrivateKey privateKey)      throws IOException, SignatureException, InvalidKeyException  {    log.entering(this.getClass().getName(), "getSelfSignedCertificate", //$NON-NLS-1$                 new Object[] { distinguishedName, publicKey, privateKey });    byte[] versionBytes = new DERValue(DER.INTEGER, BigInteger.ZERO).getEncoded();    DERValue derVersion = new DERValue(DER.CONSTRUCTED | DER.CONTEXT | 0,                                       versionBytes.length, versionBytes, null);    // NOTE (rsn): the next 3 lines should be atomic but they're not.    Preferences prefs = Preferences.systemNodeForPackage(this.getClass());    int lastSerialNumber = prefs.getInt(Main.LAST_SERIAL_NUMBER, 0) + 1;    prefs.putInt(Main.LAST_SERIAL_NUMBER, lastSerialNumber);    DERValue derSerialNumber = new DERValue(DER.INTEGER,                                            BigInteger.valueOf(lastSerialNumber));    OID signatureID = getSignatureAlgorithmOID();    DERValue derSignatureID = new DERValue(DER.OBJECT_IDENTIFIER, signatureID);    ArrayList signature = new ArrayList(1);    signature.add(derSignatureID);    // rfc-2459 states the following:    //    // for the DSA signature:    // ...Where the id-dsa-with-sha1 algorithm identifier appears as the    // algorithm field in an AlgorithmIdentifier, the encoding shall omit    // the parameters field.  That is, the AlgorithmIdentifier shall be a    // SEQUENCE of one component - the OBJECT IDENTIFIER id-dsa-with-sha1.    //     // for RSA signatures:    // ...When any of these three OIDs (i.e. xxxWithRSAEncryption) appears    // within the ASN.1 type AlgorithmIdentifier, the parameters component of    // that type shall be the ASN.1 type NULL.    if (! signatureID.equals(SHA1_WITH_DSA))      signature.add(new DERValue(DER.NULL, null));    DERValue derSignature = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE,                                         signature);    DERValue derIssuer = new DERReader(distinguishedName.getDer()).read();    long notBefore = System.currentTimeMillis();    long notAfter = notBefore + validityInDays * MILLIS_IN_A_DAY;        ArrayList validity = new ArrayList(2);    validity.add(new DERValue(DER.UTC_TIME, new Date(notBefore)));    validity.add(new DERValue(DER.UTC_TIME, new Date(notAfter)));    DERValue derValidity = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE,                                        validity);    // for a self-signed certificate subject and issuer are identical    DERValue derSubject = derIssuer;    DERValue derSubjectPublicKeyInfo = new DERReader(publicKey.getEncoded()).read();    ArrayList tbsCertificate = new ArrayList(7);    tbsCertificate.add(derVersion);    tbsCertificate.add(derSerialNumber);    tbsCertificate.add(derSignature);    tbsCertificate.add(derIssuer);    tbsCertificate.add(derValidity);    tbsCertificate.add(derSubject);    tbsCertificate.add(derSubjectPublicKeyInfo);    DERValue derTBSCertificate = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE,                                              tbsCertificate);    // The 'signature' field MUST contain the same algorithm identifier as the    // 'signatureAlgorithm' field in the sequence Certificate.    DERValue derSignatureAlgorithm = derSignature;    signatureAlgorithm.initSign(privateKey);    signatureAlgorithm.update(derTBSCertificate.getEncoded());    byte[] sigBytes = signatureAlgorithm.sign();    DERValue derSignatureValue = new DERValue(DER.BIT_STRING,                                              new BitString(sigBytes));    ArrayList certificate = new ArrayList(3);    certificate.add(derTBSCertificate);    certificate.add(derSignatureAlgorithm);    certificate.add(derSignatureValue);    DERValue derCertificate = new DERValue(DER.CONSTRUCTED | DER.SEQUENCE,                                           certificate);    ByteArrayOutputStream baos = new ByteArrayOutputStream();    DERWriter.write(baos, derCertificate);    byte[] result = baos.toByteArray();    log.exiting(this.getClass().getName(), "getSelfSignedCertificate"); //$NON-NLS-1$    return result;  }