code: private static boolean isIdentityEquivalent(X509Certificate thisCert,
              X509Certificate prevCert) {
          if (thisCert.equals(prevCert)) {
              return true;
          }
  
          // check the iPAddress field in subjectAltName extension
          Object thisIPAddress = getSubjectAltName(thisCert, 7);  // 7: iPAddress
          Object prevIPAddress = getSubjectAltName(prevCert, 7);
          if (thisIPAddress != null && prevIPAddress!= null) {
              // only allow the exactly match
              return Objects.equals(thisIPAddress, prevIPAddress);
          }
  
          // check the dNSName field in subjectAltName extension
          Object thisDNSName = getSubjectAltName(thisCert, 2);    // 2: dNSName
          Object prevDNSName = getSubjectAltName(prevCert, 2);
          if (thisDNSName != null && prevDNSName!= null) {
              // only allow the exactly match
              return Objects.equals(thisDNSName, prevDNSName);
          }
  
          // check the certificate subject and issuer
          X500Principal thisSubject = thisCert.getSubjectX500Principal();
          X500Principal prevSubject = prevCert.getSubjectX500Principal();
          X500Principal thisIssuer = thisCert.getIssuerX500Principal();
          X500Principal prevIssuer = prevCert.getIssuerX500Principal();
          if (!thisSubject.getName().isEmpty() &&
                  !prevSubject.getName().isEmpty() &&
                  thisSubject.equals(prevSubject) &&
                  thisIssuer.equals(prevIssuer)) {
              return true;
          }
  
          return false;
      }
docs: /*
  Whether the certificates can represent the same identity?
  
  The certificates can be used to represent the same identity:
  1. If the subject alternative names of IP address are present in
  both certificates, they should be identical; otherwise,
  2. if the subject alternative names of DNS name are present in
  both certificates, they should be identical; otherwise,
  3. if the subject fields are present in both certificates, the
  certificate subjects and issuers should be identical.