code: private void verifyCert(X500Name subject,
          CertificateExtensions extensions)
          throws CertificateParsingException, IOException {
  
          // if SubjectName is empty, check for SubjectAlternativeNameExtension
          if (subject.isEmpty()) {
              if (extensions == null) {
                  throw new CertificateParsingException("X.509 Certificate is " +
                          "incomplete: subject field is empty, and certificate " +
                          "has no extensions");
              }
              SubjectAlternativeNameExtension subjectAltNameExt = null;
              SubjectAlternativeNameExtension extValue = null;
              GeneralNames names = null;
              try {
                  subjectAltNameExt = (SubjectAlternativeNameExtension)
                          extensions.get(SubjectAlternativeNameExtension.NAME);
                  names = subjectAltNameExt.get(
                          SubjectAlternativeNameExtension.SUBJECT_NAME);
              } catch (IOException e) {
                  throw new CertificateParsingException("X.509 Certificate is " +
                          "incomplete: subject field is empty, and " +
                          "SubjectAlternativeName extension is absent");
              }
  
              // SubjectAlternativeName extension is empty or not marked critical
              if (names == null || names.isEmpty()) {
                  throw new CertificateParsingException("X.509 Certificate is " +
                          "incomplete: subject field is empty, and " +
                          "SubjectAlternativeName extension is empty");
              } else if (subjectAltNameExt.isCritical() == false) {
                  throw new CertificateParsingException("X.509 Certificate is " +
                          "incomplete: SubjectAlternativeName extension MUST " +
                          "be marked critical when subject field is empty");
              }
          }
      }
docs: /*
  Verify if X.509 V3 Certificate is compliant with RFC 3280.