class HttpCrlFetcher implements CrlFetcher {

  protected X509CRL download(String url) throws CertificateValidationException
  {
    try
    {
      if (url != null && url.matches("http[s]{0,1}://.*"))
      {
        X509CRL crl = httpDownload(url);
        Optional<X509Certificate> signer = trustAnchors.stream()
                                                       .filter(s -> s.getSubjectX500Principal()
                                                                     .equals(crl.getIssuerX500Principal()))
                                                       .findAny();
        if (signer.isPresent())
        {
          crl.verify(signer.get().getPublicKey(), BouncyCastleProvider.PROVIDER_NAME);
          return crl;
        }
        else
        {
          throw new CertificateValidationException("Could not verify CRL");
        }
      }
    }
    catch (CRLException | InvalidKeyException | NoSuchAlgorithmException | NoSuchProviderException
      | SignatureException e)
    {
      throw new CertificateValidationException("Could not verify CRL", e);
    }
    return null;
  }

  public  HttpCrlFetcher(Set<X509Certificate> trustAnchors);

}