@Override
        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            CertificateException origException = null;
            ByteBuffer chainDigest = calcDigestForCertificateChain(chain);
            if (chainDigest != null) {
                String errorMessage = this.previouslyRejectedClientCertChains.get(chainDigest);
                if (errorMessage != null) {
                    // Reinsert the digest, to remember that this is the most recent digest we've seen
                    addRejectedClientCertChains(chainDigest, errorMessage, true);
                    // Then throw with the original error Message
                    throw new CertificateException(errorMessage);
                }
            }
            try {
                this.origTm.checkClientTrusted(chain, authType);
                // If the last line did not throw, the chain is valid (including that none of the certificates is expired)
            } catch (CertificateException e) {
                origException = e;
                try {
                    X509Certificate[] wrappedChain = sortChainAnWrapEndCertificate(chain);
                    this.origTm.checkClientTrusted(wrappedChain, authType);
                    // No exception occurred this time. The certificate is either not yet valid or already expired
                    Date now = new Date();
                    // Check if the certificate was valid in the past
                    if (wrappedChain[0].getNotBefore().before(now)) {
                        String commonName = wrappedChain[0].getSubjectX500Principal().toString();
                        String notValidAfter = wrappedChain[0].getNotAfter().toString();
                        log.info("Certificate with common name \"" + commonName + "\" expired on " + notValidAfter);
                        // The end certificate is expired and thus will never become valid anymore, as long as the trust store is not changed
                        addRejectedClientCertChains(chainDigest, origException.getMessage(), false);
                    }

                } catch (CertificateException innerException) {
                    // Ignore this exception as we throw the original one below
                    // Even with disabled date check, this cert chain is invalid: Remember the chain and fail faster next time we see it
                    addRejectedClientCertChains(chainDigest, origException.getMessage(), false);
                }
            }
            if (origException != null) {
                throw origException;
            }
        }
A trust manager which logs the common name of an expired but otherwise valid (client) certificate before rejecting the connection attempt.
This allows to identify misconfigured clients in complex network environments, where the IP address is not sufficient.
this class wraps a standard trust manager and delegates almost all requests to it, except for cases where an invalid certificate is reported by the
standard trust manager. In this cases this manager checks whether the provided certificate is invalid only due to being expired and logs the common
name if that is the case. This trust manager will always return the results of the wrapped standard trust manager, i.e. return if the certificate is valid
or rethrow the original exception if it is not.
clients/src/main/java/org/apache/kafka/common/security/ssl/CommonNameLoggingTrustManagerFactoryWrapper.java