public static List<X509Certificate> toRootFirst(List<X509Certificate> chain)
	{
		if (chain == null || chain.isEmpty())
			throw new IllegalArgumentException("Must provide a chain that is non-null and non-empty");

		final List<X509Certificate> out;
		// Sort the list so the root certificate comes first
		if (!isSelfSigned(chain.get(0)))
		{
			// Copy the chain List so we can modify it
			out = new ArrayList<X509Certificate>(chain);

			Collections.reverse(out);

			// If, even when reversed, the chain doesn't have a root at the start then the chain's invalid
			if (!isSelfSigned(out.get(0)))
			{
				throw new IllegalArgumentException("Neither end of the certificate chain has a Root! " + chain);
			}
		}
		else
		{
			out = chain;
		}

		return Collections.unmodifiableList(out);
	}
public static List < X509Certificate > toRootFirst ( List < X509Certificate > chain ) { if ( chain == null || chain . isEmpty ( ) ) throw new IllegalArgumentException ( "Must provide a chain that is non-null and non-empty" ) ; final List < X509Certificate > out ; if ( ! isSelfSigned ( chain . get ( 0 ) ) ) { out = new ArrayList < X509Certificate > ( chain ) ; Collections . reverse ( out ) ; if ( ! isSelfSigned ( out . get ( 0 ) ) ) { throw new IllegalArgumentException ( "Neither end of the certificate chain has a Root! " + chain ) ; } } else { out = chain ; } return Collections . unmodifiableList ( out ) ; }
Take a chain and return a (Read-only) chain with the root certificate as the first entry

@param chain
a chain with the certificates in order (either leading away from root or leading towards root)

@return a read-only chain leading away from the root certificate

@throws IllegalArgumentException
if the chain is null or empty