public Pkcs10Csr generateIdentityCsr(AthenzIdentity identity, KeyPair keypair) {
        return Pkcs10CsrBuilder.fromKeypair(new X500Principal("CN=" + identity.getFullName()), keypair, SHA256_WITH_RSA)
                .addSubjectAlternativeName(String.format(
                        "%s.%s.%s",
                        identity.getName(),
                        identity.getDomainName().replace(".", "-"),
                        dnsSuffix))
                .addSubjectAlternativeName(
                        SubjectAlternativeName.Type.URI,
                        "spiffe://%s/sa/%s".formatted(identity.getDomainName(), identity.getName()))
                .build();
    }
Generates a {@link Pkcs10Csr} instance for use with {@link ZtsClient#getServiceIdentity(AthenzIdentity, String, Pkcs10Csr)}

@author bjorncs
vespa-athenz/src/main/java/com/yahoo/vespa/athenz/client/zts/utils/IdentityCsrGenerator.java