Now... I thought that CertPathBuilder would check the expiry dates, etc - and I'm running the path through CertPathValidator as well. However, self-signed certs both in the trust store and used as end-entity certs aren't checked - so I think I'll add in a check in getEndEntityCertificate() to do this.