code: private static PolicyNodeImpl rewriteLeafNodes(int certIndex,
              Set<String> initPolicies, PolicyNodeImpl rootNode) {
          Set<PolicyNodeImpl> anyNodes =
                          rootNode.getPolicyNodesValid(certIndex, ANY_POLICY);
          if (anyNodes.isEmpty()) {
              return rootNode;
          }
          PolicyNodeImpl anyNode = anyNodes.iterator().next();
          PolicyNodeImpl parentNode = (PolicyNodeImpl)anyNode.getParent();
          parentNode.deleteChild(anyNode);
          // see if there are any initialPolicies not represented by leaf nodes
          Set<String> initial = new HashSet<>(initPolicies);
          for (PolicyNodeImpl node : rootNode.getPolicyNodes(certIndex)) {
              initial.remove(node.getValidPolicy());
          }
          if (initial.isEmpty()) {
              // we deleted the anyPolicy node and have nothing to re-add,
              // so we need to prune the tree
              rootNode.prune(certIndex);
              if (rootNode.getChildren().hasNext() == false) {
                  rootNode = null;
              }
          } else {
              boolean anyCritical = anyNode.isCritical();
              Set<PolicyQualifierInfo> anyQualifiers =
                                                  anyNode.getPolicyQualifiers();
              for (String policy : initial) {
                  Set<String> expectedPolicies = Collections.singleton(policy);
                  PolicyNodeImpl node = new PolicyNodeImpl(parentNode, policy,
                      anyQualifiers, anyCritical, expectedPolicies, false);
              }
          }
          return rootNode;
      }
docs: Rewrite leaf nodes at the end of validation as described in RFC 3280
  section 6.1.5: Step (g)(iii). Leaf nodes with anyPolicy are replaced
  by nodes explicitly representing initial policies not already
  represented by leaf nodes.
  
  This method should only be called when processing the final cert
  and if the policy tree is not null and initial policies is not
  anyPolicy.
  
  @param certIndex the depth of the tree
  @param initPolicies Set of user specified initial policies
  @param rootNode the root of the policy tree