docs: private static void matchDns(String name, X509Certificate cert) throws CertificateException {
          Collection<List<?>> subjAltNames = cert.getSubjectAlternativeNames();
          if (subjAltNames != null) {
              List<String> nonMatchingDnsAltnames = new LinkedList<>();
              for (List<?> san : subjAltNames) {
                  if (((Integer) san.get(0)).intValue() != ALTNAME_DNS) {
                      continue;
                  }
                  String dnsName = (String) san.get(1);
                  if (matchesPerRfc2818(name, dnsName)) {
                      // Signal success by returning.
                      return;
                  }
                  else {
                      nonMatchingDnsAltnames.add(dnsName);
                  }
              }
              if (!nonMatchingDnsAltnames.isEmpty()) {
                  // Reject if certificate contains subject alt names, but none of them matches
                  StringBuilder sb = new StringBuilder("No subject alternative DNS name matching "
                                  + name + " found. Tried: ");
                  for (String nonMatchingDnsAltname : nonMatchingDnsAltnames) {
                      sb.append(nonMatchingDnsAltname).append(',');
                  }
                  throw new CertificateException(sb.toString());
              }
          }
  
          // Control flow will end here if the X509 certificate does not have *any* Subject
          // Alternative Names (SANs). Fallback trying to validate against the CN of the subject.
          LdapName dn = null;
          try {
              dn = new LdapName(cert.getSubjectX500Principal().getName());
          } catch (InvalidNameException e) {
              LOGGER.warning("Invalid DN: " + e.getMessage());
          }
          if (dn != null) {
              for (Rdn rdn : dn.getRdns()) {
                  if (rdn.getType().equalsIgnoreCase("CN")) {
                      if (matchesPerRfc2818(name, rdn.getValue().toString())) {
                          // Signal success by returning.
                          return;
                      }
                      break;
                  }
              }
          }
  
          throw new CertificateException("No name matching " + name + " found");
      }