public ConnectionAuthContext authorizePeer(List<X509Certificate> certChain) {
        if (authorizedPeers.isEmpty()) return ConnectionAuthContext.defaultAllCapabilities(certChain);
        X509Certificate cert = certChain.get(0);
        Set<String> matchedPolicies = new HashSet<>();
        Set<CapabilitySet> grantedCapabilities = new HashSet<>();
        String cn = X509CertificateUtils.getSubjectCommonName(cert).orElse(null);
        List<String> sans = getSubjectAlternativeNames(cert);
        log.fine(() -> String.format("Subject info from x509 certificate: CN=[%s], 'SAN=%s", cn, sans));
        for (PeerPolicy peerPolicy : authorizedPeers.peerPolicies()) {
            if (matchesPolicy(peerPolicy, cn, sans)) {
                matchedPolicies.add(peerPolicy.policyName());
                grantedCapabilities.add(peerPolicy.capabilities());
            }
        }
        // TODO Pass this through constructor
        CapabilityMode capabilityMode = TransportSecurityUtils.getCapabilityMode();
        return new ConnectionAuthContext(
                certChain, CapabilitySet.ofSets(grantedCapabilities), matchedPolicies, capabilityMode);
    }
Uses rules from {@link AuthorizedPeers} to evaluate X509 certificates

@author bjorncs
security-utils/src/main/java/com/yahoo/security/tls/PeerAuthorizer.java