@SuppressWarnings("JdkObsolete") // JcaX509v3CertificateBuilder requires java.util.Date.
  private static Certificate generateSelfSignedCertificate(final KeyPair keyPair)
      throws CertIOException, GeneralSecurityException, OperatorCreationException {
    final X500Name issuer = new X500Name(distinguishedName);
    final X500Name subject = new X500Name(distinguishedName);
    final BigInteger serialNumber = new BigInteger(String.valueOf(Instant.now().toEpochMilli()));
    final X509v3CertificateBuilder v3CertificateBuilder =
        new JcaX509v3CertificateBuilder(
            issuer,
            serialNumber,
            Date.from(Instant.now()),
            Date.from(Instant.now().plus(Period.ofDays(90))),
            subject,
            keyPair.getPublic());

    // extensions
    v3CertificateBuilder.addExtension(
        Extension.basicConstraints, true, new BasicConstraints(IS_CA));
    v3CertificateBuilder.addExtension(
        Extension.subjectAlternativeName, false, getSubjectAlternativeNames());

    final ContentSigner contentSigner =
        new JcaContentSignerBuilder("SHA256WithRSAEncryption").build(keyPair.getPrivate());

    return new JcaX509CertificateConverter()
        .setProvider(BOUNCY_CASTLE_PROVIDER)
        .getCertificate(v3CertificateBuilder.build(contentSigner));
  }
Utility class to generate temporary self-signed certificates in PKCS12 format for testing
purposes using BouncyCastle APIs. The generated certificate supports SAN extension for multiple
DNS and IP addresses

<p>Note: DO NOT USE IN PRODUCTION. The generated stores and files are marked to be deleted on JVM
exit.
ethereum/api/src/test-support/java/org/hyperledger/besu/ethereum/api/tls/SelfSignedP12Certificate.java