code: public static X509Certificate getIdentityCertificate(X509Certificate [] chain)
  	throws CertificateException {
  	if (chain == null) {
  	    throw new IllegalArgumentException(i18n.getMessage("certChainNull"));
  	}
  	GSIConstants.CertificateType certType;
  	for (int i=0;i<chain.length;i++) {
  	    certType = getCertificateType(chain[i]);
  	    if (!ProxyCertificateUtil.isImpersonationProxy(certType)) {
  		return chain[i];
  	    }
  	}
  	return null;
      }
docs: Finds the identity certificate in the given chain.
  The identity certificate is the first certificate in the
  chain that is not an impersonation proxy (full or limited)
  
  @param chain the certificate chain to find the identity
  certificate in.
  @return the identity certificate.
  @exception CertificateException if something goes wrong.