public static X509Certificate[] sortChainAnWrapEndCertificate(X509Certificate[] origChain) throws CertificateException {
            if (origChain == null || origChain.length < 1) {
                throw new CertificateException("Certificate chain is null or empty");
            }
            // Find the end certificate by looking at all issuers and find the one not referred to by any other certificate
            // There might be multiple end certificates if the chain is invalid!
            // Create a map from principal to certificate
            HashMap<X500Principal, X509Certificate> principalToCertMap = new HashMap<>();
            // First, create a map from principal of issuer (!) to certificate for easily finding the right certificates
            HashMap<X500Principal, X509Certificate> issuedbyPrincipalToCertificatesMap = new HashMap<>();
            for (X509Certificate cert: origChain) {
                X500Principal principal = cert.getSubjectX500Principal();
                X500Principal issuerPrincipal = cert.getIssuerX500Principal();
                if (issuerPrincipal.equals(principal)) {
                    // self-signed certificate in chain! This should not happen
                    boolean isCA = cert.getBasicConstraints() >= 0;
                    if (!isCA) {
                        throw new CertificateException("Self-signed certificate in chain that is not a CA!");
                    }
                }
                issuedbyPrincipalToCertificatesMap.put(issuerPrincipal, cert);
                principalToCertMap.put(principal, cert);
            }
            // Thus, expect certificate chain to be broken, e.g. containing multiple enbd certificates
            HashSet<X509Certificate> endCertificates = new HashSet<>();
            for (X509Certificate cert: origChain) {
                X500Principal subjectPrincipal = cert.getSubjectX500Principal();
                if (!issuedbyPrincipalToCertificatesMap.containsKey(subjectPrincipal)) {
                    // We found a certificate which is not an issuer of another certificate. We consider it to be an end certificate
                    endCertificates.add(cert);
                }
            }
            // There should be exactly one end certificate, otherwise we don't know which one to wrap
            if (endCertificates.size() != 1) {
                throw new CertificateException("Multiple end certificates in chain");
            }
            X509Certificate endCertificate = endCertificates.iterator().next();
            X509Certificate[] wrappedChain = new X509Certificate[origChain.length];
            // Add the wrapped certificate as first element in the new certificate chain array
            wrappedChain[0] = new NeverExpiringX509Certificate(endCertificate);
            // Add all other (potential) certificates in order of dependencies (result will be sorted from end certificate to last intermediate/root certificate)
            for (int i = 1; i < origChain.length; i++) {
                X500Principal siblingCertificateIssuer = wrappedChain[i - 1].getIssuerX500Principal();
                if (principalToCertMap.containsKey(siblingCertificateIssuer)) {
                    wrappedChain[i] = principalToCertMap.get(siblingCertificateIssuer);
                } else {
                    throw new CertificateException("Certificate chain contains certificates not belonging to the chain");
                }
            }
            return wrappedChain;
        }
This method sorts the certificate chain from end to root certificate and wraps the end certificate to make it "never-expireing"
@param origChain The original (unsorted) certificate chain
@return The sorted and wrapped certificate chain
@throws CertificateException
clients/src/main/java/org/apache/kafka/common/security/ssl/CommonNameLoggingTrustManagerFactoryWrapper.java