code: public void verify(HttpServletRequest servletRequest, byte[] serializedRequestEnvelope, RequestEnvelope deserializedRequestEnvelope) {
          String baseEncoded64Signature = servletRequest.getHeader(ServletConstants.SIGNATURE_REQUEST_HEADER);
          String signingCertificateChainUrl = servletRequest.getHeader(ServletConstants.SIGNATURE_CERTIFICATE_CHAIN_URL_REQUEST_HEADER);
          if ((baseEncoded64Signature == null) || (signingCertificateChainUrl == null)) {
              throw new SecurityException(
                      "Missing signature/certificate for the provided skill request");
          }
  
          try {
              X509Certificate signingCertificate;
              if (CERTIFICATE_CACHE.containsKey(signingCertificateChainUrl)) {
                  signingCertificate = CERTIFICATE_CACHE.get(signingCertificateChainUrl);
                  /*
                   * check the before/after dates on the certificate are still valid for the present
                   * time
                   */
                  signingCertificate.checkValidity();
              } else {
                  signingCertificate = retrieveAndVerifyCertificateChain(signingCertificateChainUrl);
  
                  // if certificate is valid, then add it to the cache
                  CERTIFICATE_CACHE.put(signingCertificateChainUrl, signingCertificate);
              }
  
              // verify that the request was signed by the provided certificate
              Signature signature = Signature.getInstance(ServletConstants.SIGNATURE_ALGORITHM);
              signature.initVerify(signingCertificate.getPublicKey());
              signature.update(serializedRequestEnvelope);
              if (!signature.verify(Base64.decodeBase64(baseEncoded64Signature
                      .getBytes(ServletConstants.CHARACTER_ENCODING)))) {
                  throw new SecurityException(
                          "Failed to verify the signature/certificate for the provided skill request");
              }
          } catch (GeneralSecurityException | IOException ex) {
              throw new SecurityException(
                      "Failed to verify the signature/certificate for the provided skill request",
                      ex);
          }
      }
docs: Verifies the certificate authenticity using the configured TrustStore and the signature of
  the skill request. This method will throw a {@link SecurityException} if the signature
  does not pass verification.
  
  {@inheritDoc}