code: public void invoke(X509Certificate cert, GSIConstants.CertificateType certType) throws CertPathValidatorException {
          if (!requireSigningPolicyCheck(certType)) {
              return;
          }
          X500Principal caPrincipal = cert.getIssuerX500Principal();
          SigningPolicy policy;
          try {
              policy = this.policyStore.getSigningPolicy(caPrincipal);
          } catch (CertStoreException e) {
              throw new CertPathValidatorException(e);
          }
  
          if (policy == null) {
              throw new CertPathValidatorException("No signing policy for " + cert.getIssuerDN());
          }
  
          boolean valid = policy.isValidSubject(cert.getSubjectX500Principal());
  
          if (!valid) {
              throw new CertPathValidatorException("Certificate " + cert.getSubjectDN()
                      + " violates signing policy for CA " + caPrincipal.getName());
          }
      }
docs: Validate DN against the signing policy
  
  @param cert     The certificate to check.
  @param certType The type of certificate to check.
  @throws CertPathValidatorException if the certificate is invalid according to the signing policy.