docs: private void verifyDocument(Document document, String docLocation)
                      throws Exception {
          // Gets the signature element within the document
          NodeList nodeList = document.getElementsByTagNameNS(XMLSignature.XMLNS,
                                                              "Signature");
          // Document does not contain a signature element
          if (nodeList.getLength() == 0) {
              printErrorMessage("error.configValidator.signatureMissing", docLocation);
              throw new IllegalStateException(
                              "Unable to find the Signature element in " +
                                              docLocation);
          }
  
          // Gets Liberty public key from hard-coded certificate
          InputStream inStream = new ByteArrayInputStream(LIBERTY_CERTIFICATE.getBytes());
          CertificateFactory certFactory = CertificateFactory.getInstance("X509");
          X509Certificate libertyCertificate = (X509Certificate)
                          certFactory.generateCertificate(inStream);
          PublicKey libertyPublicKey = libertyCertificate.getPublicKey();
  
          // Unmarshals the XML signature
          ConfigKeySelector keySelector = new ConfigKeySelector();
          DOMValidateContext valContext = new DOMValidateContext(keySelector,
                          nodeList.item(0));
          XMLSignature signature = sigFactory.unmarshalXMLSignature(valContext);
  
          // Validates the signature
          boolean sigValid = signature.validate(valContext);
          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
              Tr.debug(tc, "verifyDocument():  sigValid = " + sigValid);
  
          // Signature passed core validation
          if (sigValid) {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                  Tr.debug(tc, "verifyDocument():  Signature passed core validation");
  
              // Gets the KeyInfo from the signature
              KeyInfo keyInfo = signature.getKeyInfo();
              if (keyInfo == null) {
                  printErrorMessage("error.configValidator.keyInfoMissing", docLocation);
                  throw new IllegalStateException("Unable to find KeyInfo");
              }
  
              X509Data x509Data = null;
              X509Certificate cert = null;
  
              // Scans through elements contained in KeyInfo until X509Data 
              // found
              @SuppressWarnings("unchecked")
              List<XMLStructure> keyInfoContent = keyInfo.getContent();
              for (XMLStructure xmlStructure : keyInfoContent) {
                  if (x509Data != null) {
                      break;
                  }
  
                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                      Tr.debug(tc, "verifyDocument():  xmlStructure = " + xmlStructure);
  
                  // X509Data element found
                  if (xmlStructure instanceof X509Data) {
  
                      // Scans through elements contained in X509Data until 
                      // X509Certificate found
                      x509Data = (X509Data) xmlStructure;
                      for (Object obj : x509Data.getContent()) {
                          if (cert != null) {
                              break;
                          }
  
                          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                              Tr.debug(tc, "verifyDocument():  obj = " + obj);
  
                          // X509Certificate found
                          if (obj instanceof X509Certificate) {
  
                              // Gets document signer public key from certificate 
                              cert = (X509Certificate) obj;
                              PublicKey signerPublicKey = cert.getPublicKey();
  
                              // Document was signed by Liberty organization
                              if (signerPublicKey.equals(libertyPublicKey)) {
                                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                                      Tr.debug(tc, "Document signed by Liberty organization",
                                               docLocation);
                                  Tr.info(tc, "info.configValidator.documentValid", docLocation);
                              }
  
                              // Document was not signed by Liberty organization
                              else {
                                  if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                                      Tr.debug(tc, "verifyDocument():  Document was not signed by Liberty organization",
                                               docLocation);
  
                                  // Checks if signer certificate was issued by Liberty organization
                                  try {
                                      cert.verify(libertyPublicKey);
                                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                                          Tr.debug(tc, "verifyDocument():  Liberty organization is the CA for document signer",
                                                   docLocation);
                                      Tr.info(tc, "info.configValidator.documentValid", docLocation);
                                  }
  
                                  // Signer certificate was not issued by Liberty organization
                                  catch (Throwable t) {
                                      if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                                          Tr.debug(tc, "verifyDocument():  Liberty organization is not the CA for document signer",
                                                   docLocation);
                                      printErrorMessage("error.configValidator.signerNotAuthorized",
                                                        docLocation);
                                      FFDCFilter.processException(t, CLASS_NAME, "282", this,
                                                                  new Object[] { docLocation });
                                      throw new IllegalStateException("Signer certificate not issued by Liberty", t);
                                  }
                              }
                          }
                      }
                  }
              }
  
              // X509Data element not found
              if (x509Data == null) {
                  printErrorMessage("error.configValidator.x509DataMissing",
                                    docLocation);
                  throw new IllegalStateException("Unable to find X509Data");
              }
  
              // X509Certificate element not found
              if (cert == null) {
                  printErrorMessage("error.configValidator.x509CertificateMissing",
                                    docLocation);
                  throw new IllegalStateException("Unable to find X509Certificate");
              }
          }
  
          // Signature failed core validation
          else {
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                  Tr.debug(tc, "verifyDocument():  Signature failed core validation",
                           docLocation);
              sigValid = signature.getSignatureValue().validate(valContext);
              if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled())
                  Tr.debug(tc, "verifyDocument():  sigValid = " + sigValid);
  
              // Signature is valid - protected section of document has been 
              // modified
              if (sigValid) {
                  printErrorMessage("error.configValidator.protectedSectionModified",
                                    docLocation);
                  throw new IllegalStateException("Protectioned section of config document modified");
              }
  
              // Signature is not valid
              else {
                  printErrorMessage("error.configValidator.signatureNotValid",
                                    docLocation);
                  throw new IllegalStateException("Config document contains invalid signature");
              }
          }
  
      }