### Question:
CertificateUtils { public static SpiffeId getSpiffeId(final X509Certificate certificate) throws CertificateException { val spiffeIds = getSpiffeIds(certificate); if (spiffeIds.size() > 1) { throw new CertificateException("Certificate contains multiple SPIFFE IDs"); } if (spiffeIds.size() < 1) { throw new CertificateException("Certificate does not contain SPIFFE ID in the URI SAN"); } return SpiffeId.parse(spiffeIds.get(0)); } private  CertificateUtils(); static List<X509Certificate> generateCertificates(final byte[] input); static PrivateKey generatePrivateKey(final byte[] privateKeyBytes, AsymmetricKeyAlgorithm algorithm, KeyFileFormat keyFileFormat); static void validate(final List<X509Certificate> chain, final Collection<X509Certificate> trustedCerts); static SpiffeId getSpiffeId(final X509Certificate certificate); static TrustDomain getTrustDomain(final List<X509Certificate> chain); static void validatePrivateKey(final PrivateKey privateKey, final X509Certificate x509Certificate); static boolean isCA(final X509Certificate cert); static boolean hasKeyUsageCertSign(final X509Certificate cert); static boolean hasKeyUsageDigitalSignature(final X509Certificate cert); static boolean hasKeyUsageCRLSign(final X509Certificate cert);  }### Answer:
@Test void testGetSpiffeId() throws Exception { val rootCa = createRootCA("C = US, O = SPIFFE", "spiffe: val leaf = createCertificate("C = US, O = SPIRE", "C = US, O = SPIRE", "spiffe: SpiffeId spiffeId = CertificateUtils.getSpiffeId(leaf.getCertificate()); assertEquals(SpiffeId.parse("spiffe: }
@Test void testGetSpiffeId_certNotContainSpiffeId_throwsCertificateException() throws Exception { val rootCa = createRootCA("C = US, O = SPIFFE", "spiffe: val leaf = createCertificate("C = US, O = SPIRE", "C = US, O = SPIRE", "", rootCa, false); try { CertificateUtils.getSpiffeId(leaf.getCertificate()); fail("exception is expected"); } catch (CertificateException e) { assertEquals("Certificate does not contain SPIFFE ID in the URI SAN", e.getMessage()); } }