CertificateValidationUtil { static boolean certificateIsCa(X509Certificate certificate) { boolean[] keyUsage = certificate.getKeyUsage(); int basicConstraints = certificate.getBasicConstraints(); if (keyUsage == null) { return basicConstraints >= 0; } else { if (keyUsage[5] && basicConstraints == -1) { LOGGER.debug( "'{}' violates RFC 5280: KeyUsage keyCertSign " + "bit set without BasicConstraint cA bit set", certificate.getSubjectX500Principal().getName() ); } return keyUsage[5] || basicConstraints >= 0; } }  static PKIXCertPathBuilderResult buildTrustedCertPath(
        List<X509Certificate> certificateChain,
        Collection<X509Certificate> trustedCertificates,
        Collection<X509Certificate> issuerCertificates
    ); static void validateTrustedCertPath(
        CertPath certPath,
        TrustAnchor trustAnchor,
        Collection<X509CRL> crls,
        Set<ValidationCheck> validationChecks,
        boolean endEntityIsClient
    ); static void checkValidity(X509Certificate certificate, boolean endEntity); static void checkHostnameOrIpAddress(
        X509Certificate certificate,
        String... hostNames
    ); static void checkEndEntityKeyUsage(X509Certificate certificate); static void checkEndEntityExtendedKeyUsage(
        X509Certificate certificate,
        boolean endEntityIsClient
    ); static void checkIssuerKeyUsage(X509Certificate certificate); static void checkApplicationUri(X509Certificate certificate, String applicationUri); static String getSubjectAltNameUri(X509Certificate certificate);  }
@Test public void testCertificateIsCa() throws KeyStoreException { assertTrue(CertificateValidationUtil.certificateIsCa(getCertificate("yes-key-usage-yes-ca"))); assertTrue(CertificateValidationUtil.certificateIsCa(getCertificate("no-key-usage-yes-ca"))); assertTrue(CertificateValidationUtil.certificateIsCa(getCertificate("yes-key-usage-no-ca"))); assertFalse(CertificateValidationUtil.certificateIsCa(getCertificate("no-key-usage-no-ca"))); }