{
      "identity": "spiffe://cluster.local/ns/istio-system/sa/ztunnel",
      "state": "Initializing",
      "certChain": []
    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/another-sa",
      "state": "Unavailable: the identity is no longer needed",
      "certChain": []
    },
    {
      "identity": "spiffe://cluster.local/ns/istio-system/sa/istiod",

				t.Errorf("NewSelfSignedIstioCAOptions got unexpected error: %v", err)
			}
			cert, privateKey, certChain, rootCert := caOpts.KeyCertBundle.GetAllPem()
			if !bytes.Equal(cert, rootCert) {
				t.Error("Root cert and cert do not match")
			}
			// self signed certs do not contain cert chain
			if len(certChain) > 0 {
				t.Error("Cert chain should not exist")
			}
			rootCertCh <- rootCert

		}
	}
	if len(rootCertBytes) != 0 {
		respCertChain = append(respCertChain, string(rootCertBytes))
	}
	response := &pb.IstioCertificateResponse{
		CertChain: respCertChain,
	}
	s.monitoring.Success.Increment()
	serverCaLog.Debugf("CSR successfully signed, sans %v.", caller.Identities)
	return response, nil
}

// Adds the "istio-generated" key if the secret name is `cacerts`.
func BuildSecret(scrtName, namespace string, certChain, privateKey, rootCert, caCert, caPrivateKey []byte, secretType v1.SecretType) *v1.Secret {
	secret := &v1.Secret{
		Data: map[string][]byte{
			CertChainFile:    certChain,
			PrivateKeyFile:   privateKey,
			RootCertFile:     rootCert,
			CACertFile:       caCert,
			CAPrivateKeyFile: caPrivateKey,

// KeyCertBundle stores the cert, private key, cert chain and root cert for an entity. It is thread safe.
// The cert and privKey should be a public/private key pair.
// The cert should be verifiable from the rootCert through the certChain.
// cert and priveKey are pointers to the cert/key parsed from certBytes/privKeyBytes.
type KeyCertBundle struct {
	certBytes      []byte
	cert           *x509.Certificate
	privKeyBytes   []byte

	rootResource := security.RootCertReqResourceName
	if sds {
		workloadResource = sc.existingCertificateFile.GetResourceName()
		rootResource = sc.existingCertificateFile.GetRootResourceName()
	}

	certchain, err := os.ReadFile(sc.existingCertificateFile.CertificatePath)
	if err != nil {
		t.Fatalf("Error reading the cert chain file: %v", err)
	}
	privateKey, err := os.ReadFile(sc.existingCertificateFile.PrivateKeyPath)

	r0, _, e1 := syscall.Syscall6(procCertFindChainInStore.Addr(), 6, uintptr(store), uintptr(certEncodingType), uintptr(findFlags), uintptr(findType), uintptr(findPara), uintptr(unsafe.Pointer(prevChainContext)))
	certchain = (*CertChainContext)(unsafe.Pointer(r0))
	if certchain == nil {
		err = errnoErr(e1)
	}
	return
}

//sys   CertFindChainInStore(store Handle, certEncodingType uint32, findFlags uint32, findType uint32, findPara unsafe.Pointer, prevChainContext *CertChainContext) (certchain *CertChainContext, err error) [failretval==nil] = crypt32.CertFindChainInStore

        certChains.remove(alias);
    }

    @Override
    public Enumeration<String> engineAliases() {
        return Collections.enumeration(keys.keySet());
    }

    @Override
    public boolean engineContainsAlias(String alias) {
        return keys.containsKey(alias) || certChains.containsKey(alias);
    }

    @Override
    public int engineSize() {
        return keys.size() + certChains.size();

 */
public interface UserClassFilePermissions {

    /**
     * Describes if a certain class of users has read access to a file or directory.
     * <p>
     * Read access is the capability to view the contents of a file, or to list the contents of a directory.
     */
    boolean getRead();

    /**
     * Describes if a certain class of users has write access to a file or directory.
     * <p>