code: @Override
      public boolean match(Certificate cert) {
          if (!(cert instanceof X509Certificate)) {
              return false;
          }
  
          X509Certificate xcert = (X509Certificate)cert;
          int version = xcert.getVersion();
  
          // Check the validity period for version 1 and 2 certificate.
          if (version < 3) {
              if (startDate != null) {
                  try {
                      xcert.checkValidity(startDate);
                  } catch (CertificateException ce) {
                      return false;
                  }
              }
  
              if (endDate != null) {
                  try {
                      xcert.checkValidity(endDate);
                  } catch (CertificateException ce) {
                      return false;
                  }
              }
          }
  
          // If no SubjectKeyIdentifier extension, don't bother to check it.
          if (isSKIDSensitive &&
              (version < 3 || xcert.getExtensionValue("2.5.29.14") == null)) {
              setSubjectKeyIdentifier(null);
          }
  
          // In practice, a CA may replace its root certificate and require that
          // the existing certificate is still valid, even if the AKID extension
          // does not match the replacement root certificate fields.
          //
          // Conservatively, we only support the replacement for version 1 and
          // version 2 certificate. As for version 2, the certificate extension
          // may contain sensitive information (for example, policies), the
          // AKID need to be respected to seek the exact certificate in case
          // of key or certificate abuse.
          if (isSNSensitive && version < 3) {
              setSerialNumber(null);
          }
  
          return super.match(cert);
      }
docs: Decides whether a <code>Certificate</code> should be selected.
  
  For the purpose of compatibility, when a certificate is of
  version 1 and version 2, or the certificate does not include
  a subject key identifier extension, the selection criterion
  of subjectKeyIdentifier will be disabled.