code: boolean addMatchingCerts(X509CertSelector selector,
                               Collection<CertStore> certStores,
                               Collection<X509Certificate> resultCerts,
                               boolean checkAll)
      {
          X509Certificate targetCert = selector.getCertificate();
          if (targetCert != null) {
              // no need to search CertStores
              if (selector.match(targetCert) && !X509CertImpl.isSelfSigned
                  (targetCert, buildParams.sigProvider())) {
                  if (debug != null) {
                      debug.println("Builder.addMatchingCerts: adding target cert");
                  }
                  return resultCerts.add(targetCert);
              }
              return false;
          }
          boolean add = false;
          for (CertStore store : certStores) {
              try {
                  Collection<? extends Certificate> certs =
                                          store.getCertificates(selector);
                  for (Certificate cert : certs) {
                      if (!X509CertImpl.isSelfSigned
                          ((X509Certificate)cert, buildParams.sigProvider())) {
                          if (resultCerts.add((X509Certificate)cert)) {
                              add = true;
                          }
                      }
                  }
                  if (!checkAll && add) {
                      return true;
                  }
              } catch (CertStoreException cse) {
                  // if getCertificates throws a CertStoreException, we ignore
                  // it and move on to the next CertStore
                  if (debug != null) {
                      debug.println("Builder.addMatchingCerts, non-fatal " +
                          "exception retrieving certs: " + cse);
                      cse.printStackTrace();
                  }
              }
          }
          return add;
      }
docs: Search the specified CertStores and add all certificates matching
  selector to resultCerts. Self-signed certs are not useful here
  and therefore ignored.
  
  If the targetCert criterion of the selector is set, only that cert
  is examined and the CertStores are not searched.
  
  If checkAll is true, all CertStores are searched for matching certs.
  If false, the method returns as soon as the first CertStore returns
  a matching cert(s).
  
  Returns true iff resultCerts changed (a cert was added to the collection)