docs: @Override
      protected AuthenticationHandlerExecutionResult doAuthentication(final Credential credential) throws GeneralSecurityException {
  
          val x509Credential = (X509CertificateCredential) credential;
          val certificates = x509Credential.getCertificates();
  
          var clientCert = (X509Certificate) null;
          var hasTrustedIssuer = false;
          for (var i = certificates.length - 1; i >= 0; i--) {
              val certificate = certificates[i];
              LOGGER.debug("Evaluating [{}]", CertUtils.toString(certificate));
  
              validate(certificate);
  
              if (!hasTrustedIssuer) {
                  hasTrustedIssuer = isCertificateFromTrustedIssuer(certificate);
              }
  
              val pathLength = certificate.getBasicConstraints();
              if (pathLength < 0) {
                  LOGGER.debug("Found valid client certificate");
                  clientCert = certificate;
              } else {
                  LOGGER.debug("Found valid CA certificate");
              }
          }
          if (hasTrustedIssuer && clientCert != null) {
              x509Credential.setCertificate(clientCert);
              return new DefaultAuthenticationHandlerExecutionResult(this, x509Credential,
                  this.principalFactory.createPrincipal(x509Credential.getId()));
          }
          LOGGER.warn("Either client certificate could not be determined, or a trusted issuer could not be located");
          throw new FailedLoginException();
      }