code: private CertificateAuthenticator getCertificateAuthenticator(X509Certificate[] certChain) throws LoginException {
          CertificateAuthenticator certAuthen = null;
          ConcurrentServiceReferenceMap<String, CertificateAuthenticator> certAuthens = JAASServiceImpl.getCertificateAuthenticators();
          Set<String> keys = certAuthens.keySet();
          if (TraceComponent.isAnyTracingEnabled() && tc.isDebugEnabled()) {
              Tr.debug(tc, "CertificateAuthenticator keys:", keys);
          }
          // Iterate through the CertificateAuthenticators and call
          // authenticateCertificateChain. Return the 1st one to return true.
          for (String key : keys) {
              CertificateAuthenticator current = certAuthens.getService(key);
              if (current.authenticateCertificateChain(certChain)) {
                  certAuthen = current;
                  break;
              }
          }
          return certAuthen;
      }
docs: See if there is a CertificateAuthenticator service that will
  vouch for this cert chain. Return the 1st authenticator that
  return true from authenticateCertificateChain()
  
  @param certChain
  @throws LoginException
  @return