public static X509Certificate identifyEndEntityCertificate( Collection<X509Certificate> chain ) throws CertificateException
    {
        if ( chain.isEmpty() )
        {
            throw new CertificateException();
        }

        try
        {
            return order( chain ).get( 0 );
        }
        catch ( CertificateException ex )
        {
            Log.warn( "Unable to order the provided chain. As a fallback, the end entity certificate is assumed to be the first certificate of the input.", ex );
            return chain.iterator().next();
        }
    }
Identifies the End Entity (or 'target') certificate in a chain. In an ordered chain, this is the certificate on
the opposite end of the CA / Root Certificate.

This implementation can work with incomplete and unordered chains, as long as the provided certificates are all
part of the same chain (or chain segment). Each certificate in the chain is expected to have issued another
certificate from the chain, except for one. That one certificate is returned.

When ordering the chain fails (for example, when the collection of certificates do not belong to one linear list)
the first certificate from the chain is returned.

@param chain The chain (possibly incomplete or unordered, but not null, empty or malformed).
@return The end entity certificate (never null).
@throws CertificateException When no valid chain was provided.
xmppserver/src/main/java/org/jivesoftware/openfire/keystore/CertificateUtils.java