code: private static X509Certificate[] getCertChain(SSLSession sslSession)
      {
          try
          {
              javax.security.cert.X509Certificate javaxCerts[] = sslSession.getPeerCertificateChain();
              if (javaxCerts == null || javaxCerts.length == 0)
                  return null;
  
              int length = javaxCerts.length;
              X509Certificate[] javaCerts = new X509Certificate[length];
  
              java.security.cert.CertificateFactory cf = java.security.cert.CertificateFactory.getInstance("X.509");
              for (int i = 0; i < length; i++)
              {
                  byte bytes[] = javaxCerts[i].getEncoded();
                  ByteArrayInputStream stream = new ByteArrayInputStream(bytes);
                  javaCerts[i] = (X509Certificate) cf.generateCertificate(stream);
              }
  
              return javaCerts;
          }
          catch (SSLPeerUnverifiedException pue)
          {
              return null;
          }
          catch (Exception e)
          {
              log.warn(LogSupport.EXCEPTION, e);
              return null;
          }
      }
docs: Return the chain of X509 certificates used to negotiate the SSL Session.
  <p>
  Note: in order to do this we must convert a javax.security.cert.X509Certificate[], as used by
  JSSE to a java.security.cert.X509Certificate[],as required by the Servlet specs.
  
  @param sslSession the javax.net.ssl.SSLSession to use as the source of the cert chain.
  @return the chain of java.security.cert.X509Certificates used to negotiate the SSL
  connection. <br>
  Will be null if the chain is missing or empty.