code: private static boolean issues(X509CertImpl cert, X509CRLImpl crl,
                                    String provider) throws IOException
      {
          boolean matched = false;
  
          AdaptableX509CertSelector issuerSelector =
                                      new AdaptableX509CertSelector();
  
          // check certificate's key usage
          boolean[] usages = cert.getKeyUsage();
          if (usages != null) {
              usages[6] = true;       // cRLSign
              issuerSelector.setKeyUsage(usages);
          }
  
          // check certificate's subject
          X500Principal crlIssuer = crl.getIssuerX500Principal();
          issuerSelector.setSubject(crlIssuer);
  
          /*
           * Facilitate certification path construction with authority
           * key identifier and subject key identifier.
           *
           * In practice, conforming CAs MUST use the key identifier method,
           * and MUST include authority key identifier extension in all CRLs
           * issued. [section 5.2.1, RFC 2459]
           */
          AuthorityKeyIdentifierExtension crlAKID = crl.getAuthKeyIdExtension();
          if (crlAKID != null) {
              issuerSelector.parseAuthorityKeyIdentifierExtension(crlAKID);
          }
  
          matched = issuerSelector.match(cert);
  
          // if AKID is unreliable, verify the CRL signature with the cert
          if (matched && (crlAKID == null ||
                  cert.getAuthorityKeyIdentifierExtension() == null)) {
              try {
                  crl.verify(cert.getPublicKey(), provider);
                  matched = true;
              } catch (GeneralSecurityException e) {
                  matched = false;
              }
          }
  
          return matched;
      }
docs: Verifies whether a CRL is issued by a certain certificate
  
  @param cert the certificate
  @param crl the CRL to be verified
  @param provider the name of the signature provider