private void checkBlocklist(X509Certificate cert) throws CertificateException {
        if (blocklist != null && blocklist.isPublicKeyBlockListed(cert.getPublicKey())) {
            throw new CertificateException("Certificate blocklisted by public key: " + cert);
        }
    }
Recursively build certificate chains until a valid chain is found or all possible paths are
exhausted.
<p>
The chain is built in two sections, the complete trusted path is the the combination of
{@code untrustedChain} and {@code trustAnchorChain}. The chain begins at the leaf
certificate and ends in the final trusted root certificate.

@param certs the bag of certs provided by the peer. No order is assumed.
@param host the host being connected to.
@param clientAuth if a client is being authorized instead of a server.
@param untrustedChain the untrusted section of the chain built so far. Must be mutable.
@param trustAnchorChain the trusted section of the chain built so far. Must be mutable.
@param used the set certificates used so far in path building. Must be mutable.

@return The entire valid chain starting with the leaf certificate. This is the
concatenation of untrustedChain and trustAnchorChain.

@throws CertificateException If no valid chain could be constructed. Note that there may be
multiple reasons why no valid chain exists and there is no guarantee that the most severe is
reported in this exception. As such applications MUST NOT use the specifics of this error
for trust decisions (e.g. showing the user a click through page based on the specific error).
common/src/main/java/org/conscrypt/TrustManagerImpl.java