code: public Certificate getMatchingCert(TLSARecord tlsaRecord, List<Certificate> certs) {
  
          for (Certificate cert : certs) {
  
              byte[] digestMatch = new byte[0];
              byte[] selectorData = new byte[0];
  
              try {
                  // Get Selector Value
                  switch (tlsaRecord.getSelector()) {
                      case TLSARecord.Selector.FULL_CERTIFICATE:
                          selectorData = cert.getEncoded();
                          break;
  
                      case TLSARecord.Selector.SUBJECT_PUBLIC_KEY_INFO:
                          selectorData = cert.getPublicKey().getEncoded();
                          break;
                  }
  
                  // Validate Matching Type
                  switch (tlsaRecord.getMatchingType()) {
                      case TLSARecord.MatchingType.EXACT:
                          digestMatch = selectorData;
                          break;
                      case TLSARecord.MatchingType.SHA256:
                          digestMatch = MessageDigest.getInstance("SHA-256").digest(selectorData);
                          break;
                      case TLSARecord.MatchingType.SHA512:
                          digestMatch = MessageDigest.getInstance("SHA-512").digest(selectorData);
                          break;
                  }
              } catch (Exception e) {
                  e.printStackTrace();
              }
  
              if (Arrays.equals(digestMatch, tlsaRecord.getCertificateAssociationData())) {
                  return cert;
              }
          }
  
          return null;
      }
docs: Returns the certificate matching the TLSA record from the given certs
  
  @param tlsaRecord TLSARecord type describing the TLSA Record to be validated
  @param certs All certs retrieved from the URL's SSL/TLS connection
  @return Matching certificate or null