X509CertificateUtils { public static List<SubjectAlternativeName> getSubjectAlternativeNames(X509Certificate certificate) { try { byte[] extensionValue = certificate.getExtensionValue(SUBJECT_ALTERNATIVE_NAMES.getOId()); if (extensionValue == null) return Collections.emptyList(); ASN1Encodable asn1Encodable = ASN1Primitive.fromByteArray(extensionValue); if (asn1Encodable instanceof ASN1OctetString) { asn1Encodable = ASN1Primitive.fromByteArray(((ASN1OctetString) asn1Encodable).getOctets()); } GeneralNames names = GeneralNames.getInstance(asn1Encodable); return SubjectAlternativeName.fromGeneralNames(names); } catch (IOException e) { throw new UncheckedIOException(e); } } private  X509CertificateUtils(); static X509Certificate fromPem(String pem); static List<X509Certificate> certificateListFromPem(String pem); static String toPem(X509Certificate certificate); static String toPem(List<X509Certificate> certificates); static List<String> getSubjectCommonNames(X509Certificate certificate); static List<String> getIssuerCommonNames(X509Certificate certificate); static List<String> getSubjectOrganizationalUnits(X509Certificate certificate); static List<String> getCommonNames(X500Principal distinguishedName); static List<SubjectAlternativeName> getSubjectAlternativeNames(X509Certificate certificate); static boolean privateKeyMatchesPublicKey(PrivateKey privateKey, PublicKey publicKey);  }
@Test public void can_list_subject_alternative_names() { KeyPair keypair = KeyUtils.generateKeypair(KeyAlgorithm.EC, 256); X500Principal subject = new X500Principal("CN=myservice"); SubjectAlternativeName san = new SubjectAlternativeName(DNS_NAME, "dns-san"); X509Certificate cert = X509CertificateBuilder .fromKeypair( keypair, subject, Instant.now(), Instant.now().plus(1, ChronoUnit.DAYS), SignatureAlgorithm.SHA512_WITH_ECDSA, BigInteger.valueOf(1)) .addSubjectAlternativeName(san) .build(); List<SubjectAlternativeName> sans = X509CertificateUtils.getSubjectAlternativeNames(cert); assertThat(sans.size(), is(1)); assertThat(sans.get(0), equalTo(san)); }