import java.security.cert.CertificateParsingException;

import java.util.Collection;

import java.util.stream.Collectors;

import org.apache.commons.codec.binary.Hex;

import org.apache.commons.lang3.tuple.Pair;

        if (log.isDebugEnabled()) {

            logDetailsOnKeystore(store);

        }

    private static final Map<String, String> EXTENDED_KEY_USAGES = new HashMap<>();

    static {

        EXTENDED_KEY_USAGES.put("1.3.6.1.4.1.311.10.3.4", "Can use encrypted file systems (EFS) (EFS_CRYPTO)");

        EXTENDED_KEY_USAGES.put("1.3.6.1.4.1.311.10.3.4.1", "Can use encrypted file systems (EFS) (EFS_RECOVERY)");

        EXTENDED_KEY_USAGES.put("1.3.6.1.4.1.311.20.2.2", "Smartcard logon to Microsoft Windows");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.1",

                "Transport Layer Security (TLS) World Wide Web (WWW) server authentication");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.2",

                "Transport Layer Security (TLS) World Wide Web (WWW) client authentication");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.3", "Signing of downloadable executable code");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.4", "Email protection");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.5", "IP security end system");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.6", "IP security tunnel termination");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.7", "IP security user");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.8", "Time stamping");

        EXTENDED_KEY_USAGES.put("1.3.6.1.5.5.7.3.9", "Signing Online Certificate Status Protocol (OCSP) responses");

        EXTENDED_KEY_USAGES.put("2.5.29.37.0", "Any purpose");

    }

    private static final List<String> SAN_GENERAL_NAMES = Arrays.asList("otherName", "rfc822Name", "dNSName", "x400Address",

            "directoryName", "ediPartyName", "uniformResourceIdentifier", "iPAddress", "registeredID");

    private void logDetailsOnKeystore(KeyStore keystore) {

        Enumeration<String> aliases;

        try {

            aliases = keystore.aliases();

        } catch (KeyStoreException e) {

            log.debug("Problem reading the aliases from the store {}", keystore, e);

            return;

        }

        int i = 1;

        while(aliases.hasMoreElements()) {

            String alias = aliases.nextElement();

            log.debug("Certificate at index {} with alias {}:", i++, alias);

            X509Certificate cert;

            try {

                cert = (X509Certificate) keystore.getCertificate(alias);

            } catch (KeyStoreException e) {

                log.debug("Can't read certificate for alias {}", alias, e);

                continue;

            }

            log.debug("Subject DN: {}", cert.getSubjectX500Principal());

            log.debug("Issuer DN: {}", cert.getIssuerX500Principal());

            log.debug("Not valid before: {}", cert.getNotBefore().toInstant());

            log.debug("Not valid after: {}", cert.getNotAfter().toInstant());

            try {

                final Collection<List<?>> subjectAlternativeNames = cert.getSubjectAlternativeNames();

                if (!(subjectAlternativeNames == null || subjectAlternativeNames.isEmpty())) {

                    log.debug("SAN: {}", decodeSanList(subjectAlternativeNames));

                }

            } catch (CertificateParsingException e) {

                log.debug("Problem parsing SAN for alias {}", alias, e);

            }

            List<String> extendedKeyUsage;

            try {

                extendedKeyUsage = cert.getExtendedKeyUsage();

                if (extendedKeyUsage != null) {

                    for (String keyUsage : extendedKeyUsage) {

                        log.debug("Extended Key Usage: {} ({})", EXTENDED_KEY_USAGES.getOrDefault(keyUsage, keyUsage),

                                keyUsage);

                    }

                }

            } catch (CertificateParsingException e) {

                log.debug("Can't get extendedKeyUsage for alias {}", alias, e);

            }

        }

    }

    private String decodeSanList(Collection<List<?>> subjectAlternativeNames) {

        List<Pair<String, String>> decodedEntries = new ArrayList<>();

        for (List<?> entry : subjectAlternativeNames) {

            Object indexData = entry.get(0);

            Object data = entry.get(1);

            if (indexData instanceof Integer) {

                Integer generalNameIndex = (Integer) indexData;

                String description = sanGeneralNameIndexToName(generalNameIndex);

                String valueString = sanDataToString(data);

                decodedEntries.add(Pair.of(description, valueString));

            }

        }

        return decodedEntries.stream()

                .map(e -> e.getKey() + ": " + e.getValue())

                .collect(Collectors.joining(", "));

    }

    private String sanDataToString(Object data) {

        if (data instanceof String) {

            return (String) data;

        }

        return Hex.encodeHexString((byte[]) data);

    }

    private String sanGeneralNameIndexToName(Integer index) {

        String description;

        if (index < SAN_GENERAL_NAMES.size()) {

            description = SAN_GENERAL_NAMES.get(index);

        } else {

            description = "UNKNOWN_SAN_GENERAL_NAME";

        }

        return description;

    }