public static X509Certificate newCert(X509Certificate caCert, KeyPair caKeyPair,
    X500Name certSubject, PublicKey certPublicKey, GeneralNames subjectAltNames)
    throws IOException, OperatorCreationException, GeneralSecurityException {
    if (!caKeyPair.getPublic().equals(caCert.getPublicKey())) {
      throw new IllegalArgumentException(
        "CA private key does not match the public key in " + "the CA cert");
    }
    LocalDate now = LocalDate.now(ZoneId.systemDefault());
    X509v3CertificateBuilder builder = initCertBuilder(new X500Name(caCert.getIssuerDN().getName()),
      now, now.plusDays(1), certSubject, certPublicKey);
    builder.addExtension(Extension.basicConstraints, true, new BasicConstraints(false)); // not a CA
    builder.addExtension(Extension.keyUsage, true,
      new KeyUsage(KeyUsage.digitalSignature | KeyUsage.keyEncipherment));
    builder.addExtension(Extension.extendedKeyUsage, true, new ExtendedKeyUsage(
      new KeyPurposeId[] { KeyPurposeId.id_kp_serverAuth, KeyPurposeId.id_kp_clientAuth }));

    if (subjectAltNames != null) {
      builder.addExtension(Extension.subjectAlternativeName, false, subjectAltNames);
    }
    return buildAndSignCertificate(caKeyPair.getPrivate(), builder);
  }
Using the private key of the given CA key pair and the Subject of the given CA cert as the
Issuer, issues a new cert with the given subject and public key. The returned certificate,
combined with the private key half of the <code>certPublicKey</code>, should be used as the key
store.
@param caCert          the certificate of the CA that's doing the signing.
@param caKeyPair       the key pair of the CA. The private key will be used to sign. The public
                       key must match the public key in the <code>caCert</code>.
@param certSubject     the subject field of the new cert being issued.
@param certPublicKey   the public key of the new cert being issued.
@param subjectAltNames the subject alternative names to use, or null if none
@return a new certificate signed by the CA's private key.
hbase-common/src/test/java/org/apache/hadoop/hbase/io/crypto/tls/X509TestHelpers.java