在Netty中，我想验证证书是否是由CA颁发的

import io.netty.channel.ChannelHandlerContext;
import io.netty.channel.ChannelInitializer;
import io.netty.channel.ChannelPipeline;
import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.SslHandler;

import javax.net.ssl.SSLEngine;
import javax.net.ssl.SSLSession;
import java.security.KeyStore;
import java.security.cert.X509Certificate;

public class MyChannelInitializer extends ChannelInitializer<Channel> {
    private SslContext sslContext;

    public MyChannelInitializer(SslContext sslContext) {
        this.sslContext = sslContext;
    }

    @Override
    protected void initChannel(Channel ch) throws Exception {
        ChannelPipeline pipeline = ch.pipeline();
        SSLEngine sslEngine = sslContext.newEngine(ch.alloc());
        pipeline.addLast("ssl", new SslHandler(sslEngine));
        pipeline.addLast("handler", new MyHandler());
    }

    private class MyHandler extends ChannelInboundHandlerAdapter {
        @Override
        public void channelActive(ChannelHandlerContext ctx) throws Exception {
            SSLSession sslSession = ctx.channel().pipeline().get(SslHandler.class).engine().getSession();
            X509Certificate[] peerCertificates = (X509Certificate[]) sslSession.getPeerCertificates();
            
            // Load CA certificate
            KeyStore caKeyStore = KeyStore.getInstance("JKS");
            caKeyStore.load(...); // Load your CA certificate file

            // Verify the first certificate in the chain
            X509Certificate serverCertificate = peerCertificates[0];
            String issuerDN = serverCertificate.getIssuerDN().getName();
            PublicKey caPublicKey = caKeyStore.getCertificate("ca").getPublicKey();
            
            // Verify the certificate chain
            serverCertificate.verify(caPublicKey);

            // Certificate validation passed
            // TODO: Handle the verified certificate

            super.channelActive(ctx);
        }
    }
}