code: private void getMatchingEECerts(ForwardState currentState,
                                      List<CertStore> certStores,
                                      Collection<X509Certificate> eeCerts)
          throws IOException
      {
          if (debug != null) {
              debug.println("ForwardBuilder.getMatchingEECerts()...");
          }
          /*
           * Compose a certificate matching rule to filter out
           * certs which don't satisfy constraints
           *
           * First, retrieve clone of current target cert constraints,
           * and then add more selection criteria based on current validation
           * state. Since selector never changes, cache local copy & reuse.
           */
          if (eeSelector == null) {
              eeSelector = (X509CertSelector) targetCertConstraints.clone();
  
              /*
               * Match on certificate validity date
               */
              eeSelector.setCertificateValid(buildParams.date());
  
              /*
               * Policy processing optimizations
               */
              if (buildParams.explicitPolicyRequired()) {
                  eeSelector.setPolicy(getMatchingPolicies());
              }
              /*
               * Require EE certs
               */
              eeSelector.setBasicConstraints(-2);
          }
  
          /* Retrieve matching EE certs from CertStores */
          addMatchingCerts(eeSelector, certStores, eeCerts, searchAllCertStores);
      }
docs: /*
  Retrieves all end-entity certificates which satisfy constraints
  and requirements specified in the parameters and PKIX state.