public String generateCSR( String alias ) throws CertificateStoreConfigException
    {
        // Input validation
        if ( alias == null || alias.trim().isEmpty() )
        {
            throw new IllegalArgumentException( "Argument 'alias' cannot be null or an empty String." );
        }
        alias = alias.trim();

        try
        {
            if ( !store.containsAlias( alias ) ) {
                throw new CertificateStoreConfigException( "Cannot generate CSR for alias '"+ alias +"': the alias does not exist in the store." );
            }

            final Certificate certificate = store.getCertificate( alias );
            if (!(certificate instanceof X509Certificate))
            {
                throw new CertificateStoreConfigException( "Cannot generate CSR for alias '"+ alias +"': there is no corresponding certificate in the store, or it is not an X509 certificate." );
            }

            final Key key = store.getKey( alias, configuration.getPassword() );
            if (!(key instanceof PrivateKey))
            {
                throw new CertificateStoreConfigException( "Cannot generate CSR for alias '"+ alias +"': there is no corresponding key in the store, or it is not a private key." );
            }

            final String pemCSR = CertificateManager.createSigningRequest( (X509Certificate) certificate, (PrivateKey) key );

            return pemCSR;
        }
        catch ( IOException | KeyStoreException | UnrecoverableKeyException | NoSuchAlgorithmException | OperatorCreationException | CertificateParsingException e )
        {
            throw new CertificateStoreConfigException( "Cannot generate CSR for alias '"+ alias +"'", e );
        }
    }
Creates a Certificate Signing Request based on the private key and certificate identified by the provided alias.

When the alias does not identify a private key and/or certificate, this method will throw an exception.

The certificate that is identified by the provided alias can be an unsigned certificate, but also a certificate
that is already signed. The latter implies that the generated request is a request for certificate renewal.

An invocation of this method does not change the state of the underlying store.

@param alias An identifier for a private key / certificate in this store (cannot be null).
@return A PEM-encoded Certificate Signing Request (never null).
@throws CertificateStoreConfigException if there was a problem generating the CSR
xmppserver/src/main/java/org/jivesoftware/openfire/keystore/IdentityStore.java