title: Implementing X509TrustManager - passing on part of the verification to existing verifier
body: <p>I need to ignore the PKIX path building exception</p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:
  PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderExc
  ption: unable to find valid certification path to requested target
  </code></pre>
  
  <p>I know how to do this by writing my own class implementing <code>X509TrustManager</code> where I always <code>return true</code> from <code>isServerTrusted</code>.</p>
  
  <p>However, I don't want to trust all servers &amp; all clients.</p>
  
  <ul>
  <li>I want all the default verification to be done for clients as is done currently.</li>
  <li>For servers, I want to ignore server cert verification only for one particular cert but want to go ahead and verify it as is done currently (for eg. using cacerts store).</li>
  </ul>
  
  <p>How can I achieve something like this - i.e. pass on part of the verification to whatever was the X509TrustFactory object before I replaced it.</p>
  
  <p>i.e. this is what I want to do</p>
  
  <pre><code>public boolean isServerTrusted(X509Certificate[] chain)
  {
      if(chain[0].getIssuerDN().getName().equals("MyTrustedServer") &amp;&amp; chain[0].getSubjectDN().getName().equals("MyTrustedServer"))
          return true;
  
      // else I want to do whatever verification is normally done
  }
  </code></pre>
  
  <p>Also I don't want to disturb the existing <code>isClientTrusted</code> verification.</p>
  
  <p>How can I do this?</p>