private List<X509Certificate> checkTrusted(X509Certificate[] certs, String authType,
            SSLSession session, SSLParameters parameters, boolean clientAuth)
                    throws CertificateException {
        byte[] ocspData = null;
        byte[] tlsSctData = null;
        String hostname = null;
        if (session != null) {
            hostname = session.getPeerHost();
            ocspData = getOcspDataFromSession(session);
            tlsSctData = getTlsSctDataFromSession(session);
        }

        if (session != null && parameters != null) {
            String identificationAlgorithm = parameters.getEndpointIdentificationAlgorithm();
            if ("HTTPS".equalsIgnoreCase(identificationAlgorithm)) {
                ConscryptHostnameVerifier verifier = getHttpsVerifier();
                if (!verifier.verify(certs, hostname, session)) {
                    throw new CertificateException("No subjectAltNames on the certificate match");
                }
            }
        }
        return checkTrusted(certs, ocspData, tlsSctData, authType, hostname, clientAuth);
    }
Validates whether a server is trusted. If session is given and non-null
it also checks if chain is pinned appropriately for that peer host. If
null, it does not check for pinned certs. The return value is a list of
the certificates used for making the trust decision.
common/src/main/java/org/conscrypt/TrustManagerImpl.java