Source:
<code>private void validatePath(X509Certificate[] chain) throws NoSuchAlgorithmException, KeyStoreException, InvalidAlgorithmParameterException, CertPathValidatorException, CertPathBuilderException, CertificateException { CertPathValidator certPathValidator = CertPathValidator.getInstance("PKIX"); CertPathBuilder certPathBuilder = CertPathBuilder.getInstance("PKIX"); X509CertSelector certSelector = new X509CertSelector(); certSelector.setCertificate(chain[chain.length - 1]); certSelector.setCertificateValid(null); PKIXBuilderParameters parameters = new PKIXBuilderParameters(trustStore, certSelector); if (acceptRevoked == false) { if (checkOCSP && checkCRL) { PKIXRevocationChecker checker = (PKIXRevocationChecker) certPathBuilder.getRevocationChecker(); <START> checker.setOptions(EnumSet.of(PKIXRevocationChecker.Option.SOFT_FAIL)); <END> parameters.addCertPathChecker(checker); parameters.setRevocationEnabled(false); } else if (!checkOCSP && checkCRL) { try { loadCRL(chain); parameters.addCertStore(crlStore); parameters.setRevocationEnabled(true); } catch (CertStoreException | IOException | CRLException e) { Log.error("Couldn't load crl", e); throw new CertificateException(); } } else { parameters.setRevocationEnabled(false); } } else { parameters.setRevocationEnabled(false); } try { CertPathBuilderResult pathResult = certPathBuilder.build(parameters); CertPath certPath = pathResult.getCertPath(); PKIXCertPathValidatorResult validationResult = (PKIXCertPathValidatorResult) certPathValidator .validate(certPath, parameters); X509Certificate trustedCert = validationResult.getTrustAnchor().getTrustedCert(); if (trustedCert == null) { throw new CertificateException("certificate path failed: Trusted CA is NULL"); } for (int i = 0; i < chain.length - 1; i++) { checkBasicConstraints(chain[i]); } } catch (CertificateRevokedException e) { Log.warning("Certificate was revoked", e); throw new CertificateException("Certificate was revoked"); } }</code><technical_language>this configurable? end-user control if SOFT_FAIL apply</technical_language>

Target:
private void validatePath(X509Certificate[] chain) throws NoSuchAlgorithmException, KeyStoreException, InvalidAlgorithmParameterException, CertPathValidatorException, CertPathBuilderException, CertificateException { CertPathValidator certPathValidator = CertPathValidator.getInstance("PKIX"); CertPathBuilder certPathBuilder = CertPathBuilder.getInstance("PKIX"); X509CertSelector certSelector = new X509CertSelector(); certSelector.setCertificate(chain[chain.length - 1]); certSelector.setCertificateValid(null); PKIXBuilderParameters parameters = new PKIXBuilderParameters(trustStore, certSelector); if (acceptRevoked == false) { if (checkOCSP && checkCRL) { PKIXRevocationChecker checker = (PKIXRevocationChecker) certPathBuilder.getRevocationChecker(); if (allowSoftFail) { checker.setOptions(EnumSet.of(PKIXRevocationChecker.Option.SOFT_FAIL)); } parameters.addCertPathChecker(checker); parameters.setRevocationEnabled(false); } else if (!checkOCSP && checkCRL) { try { loadCRL(chain); parameters.addCertStore(crlStore); parameters.setRevocationEnabled(true); } catch (CertStoreException | IOException | CRLException e) { Log.error("Couldn't load crl", e); throw new CertificateException(); } } else { parameters.setRevocationEnabled(false); } } else { parameters.setRevocationEnabled(false); } try { CertPathBuilderResult pathResult = certPathBuilder.build(parameters); CertPath certPath = pathResult.getCertPath(); PKIXCertPathValidatorResult validationResult = (PKIXCertPathValidatorResult) certPathValidator .validate(certPath, parameters); X509Certificate trustedCert = validationResult.getTrustAnchor().getTrustedCert(); if (trustedCert == null) { throw new CertificateException("certificate path failed: Trusted CA is NULL"); } for (int i = 0; i < chain.length - 1; i++) { checkBasicConstraints(chain[i]); } } catch (CertificateRevokedException e) { Log.warning("Certificate was revoked", e); throw new CertificateException("Certificate was revoked"); } }