public Pkcs10Csr generateInstanceCsr(AthenzIdentity instanceIdentity,
                                         VespaUniqueInstanceId instanceId,
                                         Set<String> ipAddresses,
                                         ClusterType clusterType,
                                         KeyPair keyPair) {
        X500Principal subject = new X500Principal(String.format("OU=%s, CN=%s", providerService, instanceIdentity.getFullName()));
        // Add SAN dnsname <service>.<domain-with-dashes>.<provider-dnsname-suffix>
        // and SAN dnsname <provider-unique-instance-id>.instanceid.athenz.<provider-dnsname-suffix>
        Pkcs10CsrBuilder pkcs10CsrBuilder = Pkcs10CsrBuilder.fromKeypair(subject, keyPair, SHA256_WITH_RSA)
                .addSubjectAlternativeName(
                        DNS,
                        String.format(
                                "%s.%s.%s",
                                instanceIdentity.getName(),
                                instanceIdentity.getDomainName().replace(".", "-"),
                                dnsSuffix))
                .addSubjectAlternativeName(DNS, getIdentitySAN(instanceId))
                .addSubjectAlternativeName(URI, instanceIdentity.spiffeUri().toString());
        if (clusterType != null) pkcs10CsrBuilder.addSubjectAlternativeName(URI, clusterType.asCertificateSanUri().toString());
        ipAddresses.forEach(ip ->  pkcs10CsrBuilder.addSubjectAlternativeName(new SubjectAlternativeName(IP, ip)));
        return pkcs10CsrBuilder.build();
    }
Generates a {@link Pkcs10Csr} for an instance.

@author bjorncs
vespa-athenz/src/main/java/com/yahoo/vespa/athenz/identityprovider/client/CsrGenerator.java