class AccessToken extends OAuth2Token {

    public boolean confirmMTLSBoundToken(X509Certificate x509Cert, final String x509CertHash) {

        if (x509Cert == null) {
            LOG.error("confirmMTLSBoundToken: null certificate");
            return false;
        }

        // extract our confirmation hash claim

        final String cnfHash = (String) getConfirmEntry(CLAIM_CONFIRM_X509_HASH);
        if (cnfHash == null) {
            LOG.error("confirmMTLSBoundToken: token does not have confirmation entry");
            return false;
        }

        // first we're going to verify our expected
        // x.509 certificate hash

        if (confirmX509CertHash(x509Cert, cnfHash)) {
            return true;
        }

        // extract the certificate service identity for our
        // next set of checks

        final String cn = Crypto.extractX509CertCommonName(x509Cert);
        if (cn == null) {
            LOG.error("confirmMTLSBoundToken: null principal in certificate}");
            return false;
        }

        // check if the certificate principal matches and the
        // creation time for our cert is within our configured
        // offset timeouts

        if (confirmX509CertPrincipal(x509Cert, cn)) {
            return true;
        }

        // direct comparison of certificate cn and provided hash

        return confirmX509ProxyPrincipal(cn, x509CertHash, cnfHash);
    }

    public  AccessToken();
    public  AccessToken(final String token, JwtsSigningKeyResolver keyResolver);
    public  AccessToken(final String token, PublicKey publicKey);
    public  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert);
    public  AccessToken(final String token, JwtsSigningKeyResolver keyResolver,
                       X509Certificate x509Cert, final String x509CertHash);

}