private X509Certificate requestRoleCertificate(AthenzRole role) {
        var credentials = autoReloadingX509KeyManager.getCurrentCertificateWithKey();
        var athenzUniqueInstanceId = VespaUniqueInstanceId.fromDottedString(
                AthenzX509CertificateUtils.getInstanceId(credentials.certificate())
                        .orElseThrow()
        );
        var keyPair = KeyUtils.toKeyPair(credentials.privateKey());
        Pkcs10Csr csr = csrGenerator.generateRoleCsr(
                identity, role, athenzUniqueInstanceId, null, keyPair);
        try (ZtsClient client = createZtsClient()) {
            X509Certificate roleCertificate = client.getRoleCertificate(role, csr);
            updateRoleKeyManager(role, keyPair.getPrivate(), roleCertificate);
            log.info(String.format("Requester role certificate for role %s, expires: %s", role.toResourceNameString(), roleCertificate.getNotAfter().toInstant().toString()));
            return roleCertificate;
        }
    }
A {@link AthenzIdentityProvider} / {@link ServiceIdentityProvider} component that provides the tenant identity.

@author mortent
@author bjorncs
vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/AthenzIdentityProviderImpl.java