code: @Override
      public void check(Certificate cert, Collection<String> unresCritExts)
          throws CertPathValidatorException
      {
          X509Certificate currCert = (X509Certificate)cert;
  
          remainingCerts--;
  
          // if final certificate, check that target constraints are satisfied
          if (remainingCerts == 0) {
              if (targetConstraints != null &&
                  targetConstraints.match(currCert) == false) {
                  throw new CertPathValidatorException("target certificate " +
                      "constraints check failed");
              }
          } else {
              // otherwise, verify that keyCertSign bit is set in CA certificate
              verifyCAKeyUsage(currCert);
          }
  
          // remove the extensions that we have checked
          if (unresCritExts != null && !unresCritExts.isEmpty()) {
              unresCritExts.remove(KeyUsage_Id.toString());
              unresCritExts.remove(ExtendedKeyUsage_Id.toString());
              unresCritExts.remove(SubjectAlternativeName_Id.toString());
          }
      }
docs: Checks that keyUsage and target constraints are satisfied by
  the specified certificate.
  
  @param cert the Certificate
  @param unresolvedCritExts the unresolved critical extensions
  @throws CertPathValidatorException if certificate does not verify