public X509Certificate generateSignedCertificate(X500Name dn, KeyPair keyPair,
                int daysBeforeNow, int daysAfterNow, X500Name issuer, KeyPair parentKeyPair, boolean isCA, boolean isServerCert, boolean isClientCert)
                throws CertificateException {
            try {
                Security.addProvider(new BouncyCastleProvider());
                AlgorithmIdentifier sigAlgId =
                        new DefaultSignatureAlgorithmIdentifierFinder().find(algorithm);
                AlgorithmIdentifier digAlgId =
                        new DefaultDigestAlgorithmIdentifierFinder().find(sigAlgId);
                // Create self-signed certificate if no parentKeyPair has been specified, otherwise
                // sign with private key of parentKeyPair
                KeyPair signingKeyPair = (parentKeyPair != null) ? parentKeyPair : keyPair;
                AsymmetricKeyParameter privateKeyAsymKeyParam =
                        PrivateKeyFactory.createKey(signingKeyPair.getPrivate().getEncoded());
                SubjectPublicKeyInfo subPubKeyInfo =
                        SubjectPublicKeyInfo.getInstance(keyPair.getPublic().getEncoded());
                BcContentSignerBuilder signerBuilder;
                String keyAlgorithm = keyPair.getPublic().getAlgorithm();
                if (keyAlgorithm.equals("RSA"))
                    signerBuilder = new BcRSAContentSignerBuilder(sigAlgId, digAlgId);
                else if (keyAlgorithm.equals("DSA"))
                    signerBuilder = new BcDSAContentSignerBuilder(sigAlgId, digAlgId);
                else if (keyAlgorithm.equals("EC"))
                    signerBuilder = new BcECContentSignerBuilder(sigAlgId, digAlgId);
                else
                    throw new IllegalArgumentException("Unsupported algorithm " + keyAlgorithm);
                ContentSigner sigGen = signerBuilder.build(privateKeyAsymKeyParam);
                // Negative numbers for "days" can be used to generate expired certificates
                Date now = new Date();
                Date from = new Date(now.getTime() - daysBeforeNow * 86400000L);
                Date to = new Date(now.getTime() + daysAfterNow * 86400000L);
                BigInteger sn = new BigInteger(64, new SecureRandom());
                X500Name issuerOrDn = (issuer != null) ? issuer : dn;
                X509v3CertificateBuilder v3CertGen =
                        new X509v3CertificateBuilder(issuerOrDn, sn, from, to, dn, subPubKeyInfo);
                if (isCA) {
                    v3CertGen.addExtension(Extension.basicConstraints, true, new BasicConstraints(isCA));
                }
                if (isServerCert || isClientCert) {
                    ASN1EncodableVector purposes = new ASN1EncodableVector();
                    if (isServerCert) {
                        purposes.add(KeyPurposeId.id_kp_serverAuth);
                    }
                    if (isClientCert) {
                        purposes.add(KeyPurposeId.id_kp_clientAuth);
                    }
                    v3CertGen.addExtension(Extension.extendedKeyUsage, false, new DERSequence(purposes));
                }
                if (subjectAltName != null) {
                    v3CertGen.addExtension(Extension.subjectAlternativeName, false, subjectAltName);
                }
                X509CertificateHolder certificateHolder = v3CertGen.build(sigGen);
                return new JcaX509CertificateConverter().setProvider("BC")
                        .getCertificate(certificateHolder);
            } catch (CertificateException ce) {
                throw ce;
            } catch (Exception e) {
                throw new CertificateException(e);
            }
        }
@param dn The distinguished name to use
@param keyPair A key pair to use
@param daysBeforeNow how many days before now the Certificate is valid for
@param daysAfterNow how many days from now the Certificate is valid for
@param issuer The issuer name. if null, "dn" is used
@param parentKeyPair The parent key pair used to sign this certificate. If null, create
       self-signed certificate authority (CA)
@return A (self-) signed certificate
@throws CertificateException
clients/src/test/java/org/apache/kafka/test/TestSslUtils.java