CertPathUtil { public static boolean canBeUsedToVerifySignature(X509Certificate cert) { if (cert.getBasicConstraints() < 0) { LOGGER.debug("certificate: {}, not for CA!", cert.getSubjectDN()); return false; } if ((cert.getKeyUsage() != null && !cert.getKeyUsage()[KEY_USAGE_CERTIFICATE_SIGNING])) { LOGGER.debug("certificate: {}, not for certificate signing!", cert.getSubjectDN()); return false; } return true; }  static boolean canBeUsedToVerifySignature(X509Certificate cert); static boolean canBeUsedForAuthentication(X509Certificate cert, boolean client); static CertPath generateCertPath(List<X509Certificate> certificateChain); static CertPath generateCertPath(List<X509Certificate> certificateChain, int size); static CertPath generateValidatableCertPath(List<X509Certificate> certificateChain,
			List<X500Principal> certificateAuthorities); static CertPath validateCertificatePath(boolean truncateCertificatePath, CertPath certPath,
			X509Certificate[] trustedCertificates); static List<X509Certificate> toX509CertificatesList(List<? extends Certificate> certificates); static List<X500Principal> toSubjects(List<X509Certificate> certificates);  }
@Test public void testCanBeUsedToVerifySignature() throws Exception { X509Certificate[] certificates = TestCertificatesTools.getTrustedCertificates(); X509Certificate[] clientCertificates = TestCertificatesTools.getClientCertificateChain(); X509Certificate[] serverCertificates = TestCertificatesTools.getServerCertificateChain(); assertTrue(CertPathUtil.canBeUsedToVerifySignature(certificates[0])); assertTrue(CertPathUtil.canBeUsedToVerifySignature(certificates[1])); assertFalse(CertPathUtil.canBeUsedToVerifySignature(clientCertificates[0])); assertFalse(CertPathUtil.canBeUsedToVerifySignature(serverCertificates[0])); assertFalse(CertPathUtil.canBeUsedToVerifySignature(clientSelfsigned[0])); }