code: public static X509Certificate toX509Certificate(InputStream certificateInputStream) throws CertificateException {
          try {
              CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509", getProviderName());
              Certificate certificate = certificateFactory.generateCertificate(certificateInputStream);
              if (certificate instanceof X509Certificate) {
                  ((X509Certificate) certificate).checkValidity();
                  return (X509Certificate) certificate;
              }
              throw new IllegalStateException("The key from the input stream could not be decrypted");
          } catch (NoSuchProviderException ex) {
              throw new IllegalStateException("The key from the input stream could not be decrypted", ex);
          }
      }
docs: Load a DER Certificate from an already opened {@link InputStream}.
  The caller is responsible for closing the stream after this method completes successfully or fails.
  
  @param certificateInputStream {@link InputStream} containing the certificate.
  @return {@link X509Certificate} loaded from {@code certificateInputStream}
  @throws IllegalStateException
  If {@link X509Certificate} loading failed.
  @throws CertificateException
  If {@link X509Certificate} is invalid or cannot be loaded.