@Override
    public void verify(X509Certificate certificate, Date date) {
        logger.debug("Verifying {} issued by {}", certificate.getSubjectX500Principal(),
            certificate.getIssuerX500Principal());

        // Create trustAnchors
        final Set<TrustAnchor> trustAnchors = getTrusted().stream().map(
            c -> new TrustAnchor(c, null)
        ).collect(Collectors.toSet());
        if (trustAnchors.isEmpty()) {
            throw new VerificationException("No trust anchors available");
        }

        // Create the selector that specifies the starting certificate
        final X509CertSelector selector = new X509CertSelector();
        selector.setCertificate(certificate);

        // Configure the PKIX certificate builder algorithm parameters
        try {
            final PKIXBuilderParameters pkixParams = new PKIXBuilderParameters(trustAnchors, selector);

            // Set assume date
            if (date != null) {
                pkixParams.setDate(date);
            }

            // Add cert store with certificate to check
            pkixParams.addCertStore(CertStore.getInstance(
                "Collection", new CollectionCertStoreParameters(ImmutableList.of(certificate)), "BC"));

            // Add cert store with intermediates
            pkixParams.addCertStore(CertStore.getInstance(
                "Collection", new CollectionCertStoreParameters(getIntermediates()), "BC"));

            // Add cert store with CRLs
            pkixParams.addCertStore(CertStore.getInstance(
                "Collection", new CollectionCertStoreParameters(getCRLs()), "BC"));

            // Toggle to check revocation list
            pkixParams.setRevocationEnabled(checkRevocation());

            // Build and verify the certification chain
            final CertPathBuilder builder = CertPathBuilder.getInstance("PKIX", "BC");
            builder.build(pkixParams);
        } catch (CertPathBuilderException e) {
            throw new VerificationException(
                String.format("Invalid certificate %s issued by %s",
                    certificate.getSubjectX500Principal(), certificate.getIssuerX500Principal()
                ), e
            );
        } catch (GeneralSecurityException e) {
            throw new CryptoException(
                String.format("Could not verify certificate %s issued by %s",
                    certificate.getSubjectX500Principal(), certificate.getIssuerX500Principal()
                ), e
            );
        }
    }
@Test
    public void shouldThrowExceptionIfCertificateIsExpired() {
        thrown.expect(VerificationException.class);
        thrown.expectMessage("PPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP");
        createCertificateService(
            new String[] { "root.crt" }, new String[] { "intermediate.crt"},
            new String[0], false
        ).verify(readCert("expired.crt"), new Date(1521638102000L));
    }