public Identity getServiceIdentity(AthenzIdentity identity, String keyId, Pkcs10Csr csr, Optional<NToken> nToken) {
        URI uri = ztsUrl.resolve(String.format("instance/%s/%s/refresh", identity.getDomainName(), identity.getName()));
        RequestBuilder builder = RequestBuilder.post()
                                               .setUri(uri)
                                               .setEntity(toJsonStringEntity(new IdentityRefreshRequestEntity(csr, keyId)));
        nToken.ifPresent(n -> builder.setHeader("Athenz-Principal-Auth", n.getRawToken()));

        return execute(builder.build(), response -> {
            IdentityResponseEntity entity = readEntity(response, IdentityResponseEntity.class);
            return new Identity(entity.certificate(), entity.caCertificateBundle());
        });
    }
Default implementation of {@link ZtsClient}

@author bjorncs
@author mortent
vespa-athenz/src/main/java/com/yahoo/vespa/athenz/client/zts/DefaultZtsClient.java