if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            FileAuthenticationCA ca = new FileAuthenticationCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

    public void global(String name, ConditionOptionCall<GlobalAggregationBuilder> opLambda,

        if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            WebConfigCA ca = new WebConfigCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

        if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            ElevateWordCA ca = new ElevateWordCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

        if (opLambda != null) {
            opLambda.callback(builder);
        }
        if (aggsLambda != null) {
            RoleCA ca = new RoleCA();
            aggsLambda.callback(ca);
            ca.getAggregationBuilderList().forEach(builder::subAggregation);
        }
    }

        }
    }

    @Override
    public String toString() {
        final int len = this.length / 2 - (this.zterm ? 1 : 0);
        final char[] ca = new char[len];
        for (int i = 0; i < len; i++) {
            ca[i] = (char) this.buffer[i];
        }
        return new String(ca, 0, len);
    }

        }
    }

    @Override
    public String toString() {
        final int len = length / 2 - (zterm ? 1 : 0);
        final char[] ca = new char[len];
        for (int i = 0; i < len; i++) {
            ca[i] = (char) buffer[i];
        }
        return new String(ca, 0, len);
    }

 * certificate is signed by the certificate that follows, and the last certificate is a trusted CA
 * certificate.
 *
 * Use of the chain cleaner is necessary to omit unexpected certificates that aren't relevant to
 * the TLS handshake and to extract the trusted CA certificate for the benefit of certificate
 * pinning.
 */
abstract class CertificateChainCleaner {

    @app.get("/facilities/{facility_id}")
    def get_facility(facility_id: str) -> Facility:
        return Facility(
            id=facility_id,
            address=Address(line_1="123 Main St", city="Anytown", state_province="CA"),
        )

    client = TestClient(app)
    return client


def test_get(client: TestClient):
    response = client.get("/facilities/42")
    assert response.status_code == 200, response.text

For instance, given that TLS is enabled and you need to add trust for MinIO's own CA and for the CA of a Keycloak server, a Kubernetes secret can be created from the certificate files using `kubectl`:

```
kubectl -n minio create secret generic minio-trusted-certs --from-file=public.crt --from-file=keycloak.crt
```

If TLS is not enabled, you would need only the third party CA:

```

* Inside the `certs` directory, the private key must by named `private.key` and the public key must be named `public.crt`.
* A certificate signed by a CA contains information about the issued identity (e.g. name, expiry, public key) and any intermediate certificates. The root CA is not included.

## 3. Generate and use Self-signed Keys and Certificates with MinIO