public byte[] createChildKeyStore(ApplicationId appId, String ksPassword)
      throws Exception {
    // We don't check the expiration date, and this will provide further reason
    // for outside users to not accept these certificates
    Date from = new Date();
    Date to = from;
    KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
    keyGen.initialize(2048);
    KeyPair keyPair = keyGen.genKeyPair();
    String issuer = caCert.getSubjectX500Principal().getName();
    String subject = "CN=" + appId;
    X509Certificate cert = createCert(false, issuer, subject, from, to,
        keyPair.getPublic(), caKeyPair.getPrivate());
    if (LOG.isTraceEnabled()) {
      LOG.trace("Certificate for {}: \n{}", appId, cert);
    }

    KeyStore keyStore = createChildKeyStore(ksPassword, "server",
        keyPair.getPrivate(), cert);
    return keyStoreToBytes(keyStore, ksPassword);
  }
@Test
  void testCreateChildKeyStore() throws Exception {
    ProxyCA proxyCA = new ProxyCA();
    proxyCA.init();
    ApplicationId appId =
        ApplicationId.newInstance(System.currentTimeMillis(), 1);
    byte[] keystoreBytes = proxyCA.createChildKeyStore(appId,
        "password");
    KeyStore keyStore = KeyStoreTestUtil.bytesToKeyStore(keystoreBytes,
        "password");
    assertEquals(1, keyStore.size());
    Certificate[] certChain = keyStore.getCertificateChain("server");
    assertEquals(2, certChain.length);
    X509Certificate caCert = (X509Certificate) certChain[1];
    X509Certificate cert = (X509Certificate) certChain[0];

    // check child cert
    assertEquals(caCert.getSubjectX500Principal().toString(),
        cert.getIssuerDN().toString());
    assertEquals(new X500Principal("CN=" + appId),
        cert.getSubjectX500Principal());
    assertFalse(cert.getSubjectX500Principal().toString().contains(","),
        "Found multiple fields in X500 Principal, when there " +
            "should have only been one: " + cert.getSubjectX500Principal());
    assertEquals("SHA512withRSA", cert.getSigAlgName());
    assertEquals(cert.getNotBefore(), cert.getNotAfter());
    assertTrue(cert.getNotAfter().before(new Date()),
        "Expected certificate to be expired but was not: " + cert.getNotAfter());
    assertEquals(new X500Principal("CN=" + appId).toString(),
        cert.getSubjectDN().toString());
    Key privateKey = keyStore.getKey("server", "password".toCharArray());
    assertEquals("RSA", privateKey.getAlgorithm());
    assertEquals(-1, cert.getBasicConstraints());

    // verify signature on child cert
    PublicKey caPublicKey = caCert.getPublicKey();
    cert.verify(caPublicKey);

    // check CA cert
    checkCACert(caCert);
    assertEquals(proxyCA.getCaCert(), caCert);

    // verify signature on CA cert
    caCert.verify(caPublicKey);

    // verify CA public key matches private key
    PrivateKey caPrivateKey =
        proxyCA.getX509KeyManager().getPrivateKey(null);
    checkPrivatePublicKeys(caPrivateKey, caPublicKey);
    assertEquals(proxyCA.getCaKeyPair().getPublic(), caPublicKey);
    assertEquals(proxyCA.getCaKeyPair().getPrivate(), caPrivateKey);
  }