public
  static
  boolean
  verify
  (
    X509Certificate x509certificateRoot,
    Collection collectionX509CertificateChain,
    String stringTarget
  )
  {
    int nSize = collectionX509CertificateChain.size();
    X509Certificate [] arx509certificate = new X509Certificate [nSize];
    collectionX509CertificateChain.toArray(arx509certificate);

    // Working down the chain, for every certificate in the chain,
    // verify that the subject of the certificate is the issuer of the
    // next certificate in the chain.
    Principal principalLast = null;
    for (int i = 0; i < nSize; i++)
    {
      X509Certificate x509certificate = arx509certificate[i];
      Principal principalIssuer = x509certificate.getIssuerDN();
      Principal principalSubject = x509certificate.getSubjectDN();
      if (principalLast != null)
      {
        if (principalIssuer.equals(principalLast))
        {
          try
          {
            PublicKey publickey = arx509certificate[i - 1].getPublicKey();
            arx509certificate[i].verify(publickey);
          }
          catch (GeneralSecurityException generalsecurityexception)
          {
            System.out.println("signature verification failed");
            return false;
          }
        }
        else
        {
          System.out.println("subject/issuer verification failed");
          return false;
        }
      }
      principalLast = principalSubject;
    }

    // Verify that the the first certificate in the chain was issued
    // by a third-party that the client trusts.
    try
    {
      PublicKey publickey = x509certificateRoot.getPublicKey();
      arx509certificate[0].verify(publickey);
    }
    catch (GeneralSecurityException generalsecurityexception)
    {
      System.out.println("signature verification failed");
      return false;
    }

    // Verify that the last certificate in the chain corresponds to
    // the server we desire to authenticate.
    Principal principalSubject = arx509certificate[nSize -
1].getSubjectDN();
    if (!stringTarget.equals(principalSubject.getName()))
    {
      System.out.println("target verification failed");
      return false;
    }

    // For every certificate in the chain, verify that the certificate
    // is valid at the current time.
    Date date = new Date();
    for (int i = 0; i < nSize; i++)
    {
      try
      {
        arx509certificate[i].checkValidity(date);
      }
      catch (GeneralSecurityException generalsecurityexception)
      {
        System.out.println("invalid date");
        return false;
      }
    }

    return true;
  }

Resources

"Construct Secure Networked Applications with Certificates," Todd Sundsted (JavaWorld)

Part 1: Certificates add value to public-key cryptography (January 12, 2001)
Part 2: Learn to use the X.509 certificates (February 16, 2001)
Part 3: Use the Java CRL and X509CRL classes (March 16, 2001)
Part 4: Authenticate clients and servers, and verify certificate chains (April 13, 2001)

Download the source and resource files that accompany this article:
http://www.javaworld.com/javaworld/jw-04-2001/howto/jw-0413-howto.zip

JCE (Java Cryptography Extension): http://java.sun.com/products/jce/

JSSE (Java Secure Socket Extension): http://java.sun.com/products/jsse/

Sun's documentation: http://java.sun.com/j2se/1.3/docs/api/java/security/cert/package-summary.html

Internet X.509 Public Key Infrastructure -- Certificate and CRL Profile:
http://www.ietf.org/rfc/rfc2459.txt

The emerging specification that will make RFC 2459 obsolete (note that this URL may change as the spec is updated): http://www.ietf.org/internet-drafts/draft-ietf-pkix-new-part1-06.txt


Information on Java Specification Request #55:
http://java.sun.com/aboutJava/communityprocess/jsr/jsr_055_certp.html

Read more articles on Java Security in the JavaWorld Topical Index:
http://www.javaworld.com/javaworld/topicalindex/jw-ti-security.html

Have a security question? Check out ITworld.com's Java Security discussion:
http://www.itworld.com/jump/jw-0413-howto/forums.itworld.com/webx?14@@.ee6b80e

Sign up for the Java Security newsletter to learn more preventive measures:
http://reg.itworld.com/cgi-bin/subcontent12.cgi

For a complete listing of all How-To Java columns:
http://www.javaworld.com/javaworld/topicalindex/jw-ti-howto.html