@Test
    void operator_certificates_are_joined_with_clients_pem() {
        var applicationPackage = new MockApplicationPackage.Builder()
                .withRoot(applicationFolder)
                .build();

        var applicationTrustCert = X509CertificateUtils.toPem(
                X509CertificateUtils.createSelfSigned("CN=application", Duration.ofDays(1)).certificate());
        var operatorCert = X509CertificateUtils.createSelfSigned("CN=operator", Duration.ofDays(1)).certificate();

        applicationPackage.getFile(Path.fromString("security")).createDirectory();
        applicationPackage.getFile(Path.fromString("security/clients.pem")).writeFile(new StringReader(applicationTrustCert));

        var deployState = new DeployState.Builder().properties(
                new TestProperties()
                        .setOperatorCertificates(List.of(operatorCert))
                        .setHostedVespa(true)
                        .setEndpointCertificateSecrets(Optional.of(new EndpointCertificateSecrets("CERT", "KEY"))))
                .zone(new Zone(SystemName.PublicCd, Environment.dev, RegionName.defaultName()))
                .applicationPackage(applicationPackage)
                .build();

        Element clusterElem = DomBuilderTest.parse("<container version='1.0' />");

        createModel(root, deployState, null, clusterElem);

        ApplicationContainer container = (ApplicationContainer) root.getProducer("container/container.0");
        List<ConnectorFactory> connectorFactories = container.getHttp().getHttpServer().get().getConnectorFactories();
        ConnectorFactory tlsPort = connectorFactories.stream().filter(connectorFactory -> connectorFactory.getListenPort() == 4443).findFirst().orElseThrow();

        ConnectorConfig.Builder builder = new ConnectorConfig.Builder();
        tlsPort.getConfig(builder);

        ConnectorConfig connectorConfig = new ConnectorConfig(builder);
        var caCerts = X509CertificateUtils.certificateListFromPem(connectorConfig.ssl().caCertificate());
        assertEquals(2, caCerts.size());
        List<String> certnames = caCerts.stream()
                .map(cert -> cert.getSubjectX500Principal().getName())
                .toList();
        assertThat(certnames, containsInAnyOrder("CN=operator", "CN=application"));
    }
@author gjoranv
@author bjorncs
@author mortent
config-model/src/test/java/com/yahoo/vespa/model/container/xml/AccessControlTest.java