@Override
    public XMLObject filter(
        @Nullable
        final XMLObject metadata,
        @Nonnull
        final MetadataFilterContext context) throws FilterException {

        if (metadata instanceof final EntityDescriptor ed) {
            for (val role : ed.getRoleDescriptors()) {
                for (val kd : role.getKeyDescriptors()) {
                    val ki = kd.getKeyInfo();
                    for (val x509 : ki.getX509Datas()) {
                        for (val xmlCert : x509.getX509Certificates()) {
                            try {
                                val cert = X509Support.decodeCertificate(xmlCert.getValue());
                                LOGGER.debug("Evaluating certificate [{}] in metadata for [{}]. Not Before [{}], Not After [{}]",
                                    cert.getSubjectX500Principal().getName(), ed.getEntityID(), cert.getNotBefore(), cert.getNotAfter());
                                cert.checkValidity();
                            } catch (final CertificateException e) {
                                LoggingUtils.error(LOGGER, e);
                                throw new FilterException("Expired or invalid certificate in metadata for " + ed.getEntityID());
                            }
                        }
                    }
                }
            }
        }
        return metadata;
    }
This is {@link EntityDescriptorCertificatesExpirationFilter}.

@author Misagh Moayyed
@since 7.3.0
support/cas-server-support-saml-idp-metadata/src/main/java/org/apereo/cas/support/saml/services/idp/metadata/filter/EntityDescriptorCertificatesExpirationFilter.java