@Override
  public Principal authenticate(final Properties credentials, final DistributedMember member)
      throws AuthenticationFailedException {
    final String alias = (String) credentials.get(PKCSAuthInit.KEYSTORE_ALIAS);
    if (alias == null || alias.length() <= 0) {
      throw new AuthenticationFailedException("No alias received");
    }

    try {
      final X509Certificate cert = getCertificate(alias);
      if (cert == null) {
        throw newException("No certificate found for alias:" + alias);
      }

      final byte[] signatureBytes = (byte[]) credentials.get(PKCSAuthInit.SIGNATURE_DATA);
      if (signatureBytes == null) {
        throw newException(
            "signature data property [" + PKCSAuthInit.SIGNATURE_DATA + "] not provided");
      }

      final Signature sig = Signature.getInstance(cert.getSigAlgName());
      sig.initVerify(cert);
      sig.update(alias.getBytes(StandardCharsets.UTF_8));

      if (!sig.verify(signatureBytes)) {
        throw newException("verification of client signature failed");
      }

      return new PKCSPrincipal(alias);

    } catch (Exception ex) {
      throw newException(ex.toString(), ex);
    }
  }
An implementation of {@link Authenticator} that uses PKCS.
geode-dunit/src/main/java/org/apache/geode/security/templates/PKCSAuthenticator.java