code: private Collection<X509Certificate> getMatchingEECerts
          (ReverseState currentState, List<CertStore> certStores)
          throws CertStoreException, CertificateException, IOException {
  
          /*
           * Compose a CertSelector to filter out
           * certs which do not satisfy requirements.
           *
           * First, retrieve clone of current target cert constraints, and
           * then add more selection criteria based on current validation state.
           */
          X509CertSelector sel = (X509CertSelector) targetCertConstraints.clone();
  
          /*
           * Match on issuer (subject of previous cert)
           */
          sel.setIssuer(currentState.subjectDN);
  
          /*
           * Match on certificate validity date.
           */
          sel.setCertificateValid(buildParams.date());
  
          /*
           * Policy processing optimizations
           */
          if (currentState.explicitPolicy == 0)
              sel.setPolicy(getMatchingPolicies());
  
          /*
           * If previous cert has a subject key identifier extension,
           * use it to match on authority key identifier extension.
           */
          /*if (currentState.subjKeyId != null) {
            AuthorityKeyIdentifierExtension authKeyId = new AuthorityKeyIdentifierExtension(
                  (KeyIdentifier) currentState.subjKeyId.get(SubjectKeyIdentifierExtension.KEY_ID),
                  null, null);
          sel.setAuthorityKeyIdentifier(authKeyId.getExtensionValue());
          }*/
  
          /*
           * Require EE certs
           */
          sel.setBasicConstraints(-2);
  
          /* Retrieve matching certs from CertStores */
          HashSet<X509Certificate> eeCerts = new HashSet<>();
          addMatchingCerts(sel, certStores, eeCerts, true);
  
          if (debug != null) {
              debug.println("ReverseBuilder.getMatchingEECerts got "
                            + eeCerts.size() + " certs.");
          }
          return eeCerts;
      }
docs: /*
  Retrieves all end-entity certificates which satisfy constraints
  and requirements specified in the parameters and PKIX state.