@Test
    public void testSelfSignedExpired() throws Exception
    {
        // Setup fixture.
        final X509Certificate[] chain = new X509Certificate[] { KeystoreTestUtils.generateExpiredSelfSignedCertificate().getCertificate() };
        final X509CertSelector selector = new X509CertSelector();
        selector.setSubject( chain[ 0 ].getSubjectX500Principal() );

        // Execute system under test.
        CertPath result = null;
        CertPathBuilderException exception = null;

        try
        {
            result = trustManager.checkChainTrusted( selector, chain );
        }
        catch ( CertPathBuilderException ex)
        {
            exception = ex;
        }

        // Verify results
        if ( acceptSelfSigned && !checkValidity)
        {
            Assert.assertNotNull( "Certificate validity is not checked, and self-signed certificates are accepted. Validation should have succeeded.", result );
        }
        else
        {
            final StringBuilder sb = new StringBuilder();
            if ( checkValidity )
            {
                sb.append( "Certificate validity is checked. " );
            }

            if ( !acceptSelfSigned )
            {
                sb.append( "Self-signed certificates are not accepted. " );
            }
            Assert.assertNotNull( sb + "Validation should have thrown an exception.", exception );
        }
    }
Verifies that self-signed certificates that expired are accepted only when both self-signed certificates are
explicitly accepted, as well as validation is explicitly skipped.
xmppserver/src/test/java/org/jivesoftware/openfire/keystore/CheckChainTrustedTest.java