code: void validateRevocationStatus(X509Certificate[] chain, String peerHost) throws CertificateException
    {
      final List<Certificate> bcChain = convertToBouncyCastleCertificate(chain);
      final List<SFPair<Certificate, Certificate>> pairIssuerSubjectList =
          getPairIssuerSubject(bcChain);
  
      if (peerHost.startsWith("ocspssd"))
      {
        return;
      }
  
      if (ocspCacheServer.new_endpoint_enabled)
      {
        ocspCacheServer.resetOCSPResponseCacheServer(peerHost);
      }
  
      synchronized (OCSP_RESPONSE_CACHE_LOCK)
      {
        boolean isCached = isCached(pairIssuerSubjectList);
        if (this.useOcspResponseCacheServer && !isCached)
        {
          if (!ocspCacheServer.new_endpoint_enabled)
          {
            LOGGER.debug(
                "Downloading OCSP response cache from the server. URL: {}",
                SF_OCSP_RESPONSE_CACHE_SERVER_URL);
          }
          else
          {
            LOGGER.debug(
                "Downloading OCSP response cache from the server. URL: {}",
                ocspCacheServer.SF_OCSP_RESPONSE_CACHE_SERVER);
          }
          readOcspResponseCacheServer();
          // if the cache is downloaded from the server, it should be written
          // to the file cache at all times.
          WAS_CACHE_UPDATED = true;
        }
        executeRevocationStatusChecks(pairIssuerSubjectList, peerHost);
        if (WAS_CACHE_UPDATED)
        {
          JsonNode input = encodeCacheToJSON();
          fileCacheManager.writeCacheFile(input);
          WAS_CACHE_UPDATED = false;
        }
      }
    }
docs: Certificate Revocation checks
  
  @param chain    chain of certificates attached.
  @param peerHost Hostname of the server
  @throws CertificateException if any certificate validation fails