private static boolean isMaybePkcs7(byte[] header) {
        // The outer tag must be SEQUENCE.
        if (header.length < 2 || header[0] != VALUE_0) {
            return false;
        }

        // Bytes are signed in Java.
        int lengthByte = header[1] & 0xff;

        // Skip the length prefix to find the tag of the first child of SEQUENCE. This function is
        // intentionally lax and does not attempt to parse the length itself. It is only necessary
        // to return true on PKCS#7 inputs and false on X.509 inputs. Other structures can go either
        // way.
        int idx = 2;
        if (lengthByte <= 0x80) {
            // Short-form or indefinite length.
        } else if (lengthByte == 0x81) {
            idx += 1;
        } else if (lengthByte == 0x82) {
            idx += 2;
        } else if (lengthByte == 0x83) {
            idx += 3;
        } else if (lengthByte == 0x84) {
            idx += 4;
        } else {
            // BoringSSL stops at 4-byte lengths. A 5-byte length would require a 4GiB input.
            return false;
        }

        // The first element of a PKCS#7 structure is OBJECT IDENTIFIER, which has tag 6. The first
        // element of an X.509 structure is never OBJECT IDENTIFIER.
        return idx < header.length && header[idx] == 0x06;
    }
An implementation of {@link java.security.cert.CertificateFactory} based on BoringSSL.
common/src/main/java/org/conscrypt/OpenSSLX509CertificateFactory.java