code: private Collection<X509Certificate> getMatchingCACerts
          (ReverseState currentState, List<CertStore> certStores)
          throws CertificateException, CertStoreException, IOException {
  
          /*
           * Compose a CertSelector to filter out
           * certs which do not satisfy requirements.
           */
          X509CertSelector sel = new X509CertSelector();
  
          /*
           * Match on issuer (subject of previous cert)
           */
          sel.setIssuer(currentState.subjectDN);
  
          /*
           * Match on certificate validity date.
           */
          sel.setCertificateValid(buildParams.date());
  
          /*
           * Match on target subject name (checks that current cert's
           * name constraints permit it to certify target).
           * (4 is the integer type for DIRECTORY name).
           */
          byte[] subject = targetCertConstraints.getSubjectAsBytes();
          if (subject != null) {
              sel.addPathToName(4, subject);
          } else {
              X509Certificate cert = targetCertConstraints.getCertificate();
              if (cert != null) {
                  sel.addPathToName(4,
                                    cert.getSubjectX500Principal().getEncoded());
              }
          }
  
          /*
           * Policy processing optimizations
           */
          if (currentState.explicitPolicy == 0)
              sel.setPolicy(getMatchingPolicies());
  
          /*
           * If previous cert has a subject key identifier extension,
           * use it to match on authority key identifier extension.
           */
          /*if (currentState.subjKeyId != null) {
            AuthorityKeyIdentifierExtension authKeyId = new AuthorityKeyIdentifierExtension(
                  (KeyIdentifier) currentState.subjKeyId.get(SubjectKeyIdentifierExtension.KEY_ID),
                                  null, null);
            sel.setAuthorityKeyIdentifier(authKeyId.getExtensionValue());
          }*/
  
          /*
           * Require CA certs
           */
          sel.setBasicConstraints(0);
  
          /* Retrieve matching certs from CertStores */
          ArrayList<X509Certificate> reverseCerts = new ArrayList<>();
          addMatchingCerts(sel, certStores, reverseCerts, true);
  
          /* Sort remaining certs using name constraints */
          Collections.sort(reverseCerts, new PKIXCertComparator());
  
          if (debug != null)
              debug.println("ReverseBuilder.getMatchingCACerts got " +
                            reverseCerts.size() + " certs.");
          return reverseCerts;
      }
docs: /*
  Retrieves all CA certificates which satisfy constraints
  and requirements specified in the parameters and PKIX state.