public static void verifyChain ( List < X509Certificate > chain ) { if ( chain == null || chain . isEmpty ( ) ) throw new IllegalArgumentException ( "Must provide a chain that is non-null and non-empty" ) ; for ( int i = 0 ; i < chain . size ( ) ; i ++ ) { final X509Certificate certificate = chain . get ( i ) ; final int issuerIndex = ( i != 0 ) ? i - 1 : 0 ; // The index of the issuer is the previous cert (& the root must, of course, sign itself) final X509Certificate issuer = chain . get ( issuerIndex ) ; // Verify the certificate was indeed issued by the previous certificate in the chain try { certificate . verify ( issuer . getPublicKey ( ) ) ; } catch ( GeneralSecurityException e ) { final String msg = "Failure verifying " + certificate + " against claimed issuer " + issuer ; throw new IllegalArgumentException ( msg + ": " + e . getMessage ( ) , e ) ; } } }
Verifies that a certificate chain is valid