code: private void clientCertificateVerify(CertificateVerify mesg)
              throws IOException {
  
          if (debug != null && Debug.isOn("handshake")) {
              mesg.print(System.out);
          }
  
          if (protocolVersion.v >= ProtocolVersion.TLS12.v) {
              SignatureAndHashAlgorithm signAlg =
                  mesg.getPreferableSignatureAlgorithm();
              if (signAlg == null) {
                  throw new SSLHandshakeException(
                          "Illegal CertificateVerify message");
              }
  
              String hashAlg =
                  SignatureAndHashAlgorithm.getHashAlgorithmName(signAlg);
              if (hashAlg == null || hashAlg.length() == 0) {
                  throw new SSLHandshakeException(
                          "No supported hash algorithm");
              }
  
              handshakeHash.setCertificateVerifyAlg(hashAlg);
          }
  
          try {
              PublicKey publicKey =
                  session.getPeerCertificates()[0].getPublicKey();
  
              boolean valid = mesg.verify(protocolVersion, handshakeHash,
                                          publicKey, session.getMasterSecret());
              if (valid == false) {
                  fatalSE(Alerts.alert_bad_certificate,
                              "certificate verify message signature error");
              }
          } catch (GeneralSecurityException e) {
              fatalSE(Alerts.alert_bad_certificate,
                  "certificate verify format error", e);
          }
  
          // reset the flag for clientCertificateVerify message
          needClientVerify = false;
      }
docs: /*
  Client wrote a message to verify the certificate it sent earlier.
  
  Note that this certificate isn't involved in key exchange.  Client
  authentication messages are included in the checksums used to
  validate the handshake (e.g. Finished messages).  Other than that,
  the _exact_ identity of the client is less fundamental to protocol
  security than its role in selecting keys via the pre-master secret.