private boolean validateKeyChain(X509Certificate client, X509Certificate... trustedCerts) throws CertificateException, InvalidAlgorithmParameterException, NoSuchAlgorithmException, NoSuchProviderException {

        boolean found = false;
        int i = trustedCerts.length;

        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        TrustAnchor anchor;
        Set<TrustAnchor> anchors;
        CertPath path;
        List<Certificate> list;
        PKIXParameters params;
        CertPathValidator validator = CertPathValidator.getInstance("PKIX");

        while (!found && i > 0) {
            anchor = new TrustAnchor(trustedCerts[--i], null);
            anchors = Collections.singleton(anchor);

            list = Arrays.asList(new Certificate[]{client});
            path = cf.generateCertPath(list);
            params = new PKIXParameters(anchors);
            params.setRevocationEnabled(false);

            if (client.getIssuerDN().equals(trustedCerts[i].getSubjectDN())) {

                try {
                    validator.validate(path, params);
                    if (isSelfSigned(trustedCerts[i])) {
                        // found root ca
                        found = true;
                    } else if (!client.equals(trustedCerts[i])) {
                        // find parent ca
                        found = validateKeyChain(trustedCerts[i], trustedCerts);
                    }

                } catch (CertPathValidatorException e) {
                    // validation fail, check next certificate in the trustedCerts array
                }

            }

        }

        return found;
    }
private boolean validateKeyChain ( X509Certificate client , X509Certificate ... trustedCerts ) throws CertificateException , InvalidAlgorithmParameterException , NoSuchAlgorithmException , NoSuchProviderException { boolean found = false ; int i = trustedCerts . length ; CertificateFactory cf = CertificateFactory . getInstance ( "X.509" ) ; TrustAnchor anchor ; Set < TrustAnchor > anchors ; CertPath path ; List < Certificate > list ; PKIXParameters params ; CertPathValidator validator = CertPathValidator . getInstance ( "PKIX" ) ; while ( ! found && i > 0 ) { anchor = new TrustAnchor ( trustedCerts [ -- i ] , null ) ; anchors = Collections . singleton ( anchor ) ; list = Arrays . asList ( new Certificate [ ] { client } ) ; path = cf . generateCertPath ( list ) ; params = new PKIXParameters ( anchors ) ; params . setRevocationEnabled ( false ) ; if ( client . getIssuerDN ( ) . equals ( trustedCerts [ i ] . getSubjectDN ( ) ) ) { try { validator . validate ( path , params ) ; if ( isSelfSigned ( trustedCerts [ i ] ) ) { found = true ; } else if ( ! client . equals ( trustedCerts [ i ] ) ) { found = validateKeyChain ( trustedCerts [ i ] , trustedCerts ) ; } } catch ( CertPathValidatorException e ) { } } } return found ; }
Validate keychain

@param client       is the client X509Certificate
@param trustedCerts is Array containing all trusted X509Certificate
@return true if validation until root certificate success, false otherwise
@throws CertificateException Certificate is invalid
@throws InvalidAlgorithmParameterException Algorithm parameter is invalid
@throws NoSuchAlgorithmException No Such Algorithm Exists
@throws NoSuchProviderException No Such Security Provider Exists