code: public static List<X509Certificate> toRootFirst(List<X509Certificate> chain)
  	{
  		if (chain == null || chain.isEmpty())
  			throw new IllegalArgumentException("Must provide a chain that is non-null and non-empty");
  
  		final List<X509Certificate> out;
  		// Sort the list so the root certificate comes first
  		if (!isSelfSigned(chain.get(0)))
  		{
  			// Copy the chain List so we can modify it
  			out = new ArrayList<X509Certificate>(chain);
  
  			Collections.reverse(out);
  
  			// If, even when reversed, the chain doesn't have a root at the start then the chain's invalid
  			if (!isSelfSigned(out.get(0)))
  			{
  				throw new IllegalArgumentException("Neither end of the certificate chain has a Root! " + chain);
  			}
  		}
  		else
  		{
  			out = chain;
  		}
  
  		return Collections.unmodifiableList(out);
  	}
docs: Take a chain and return a (Read-only) chain with the root certificate as the first entry
  
  @param chain
  a chain with the certificates in order (either leading away from root or leading towards root)
  
  @return a read-only chain leading away from the root certificate
  
  @throws IllegalArgumentException
  if the chain is null or empty