Currently the CertUtils.verifySystemCerts() checks the validity for all system certificates before returning the result without identifying which certificate failed the verification (except in the debug log):

StringTokenizer tokenizer = new StringTokenizer(certlist, ",");
while (tokenizer.hasMoreTokens()) {
    String tag = tokenizer.nextToken();
    tag = tag.trim();
    CMS.debug("CertUtils: verifySystemCerts() cert tag=" + tag);
    verifyResult = verifySystemCertByTag(tag);
    if (verifyResult == false)
        r = false; //r captures the value for final return
}

Once a certificate is found to be invalid, checking other certificates is actually redundant. The code is not very informative since it only returns a boolean value, so there's no way to identify programmatically which certificate is invalid. It's also hard to troubleshoot because the invalid certificate is only reported briefly in the debug log and it can be hidden among various other debug logs.

Ideally once a certificate is found to be invalid the code should return immediately and identify the certificate, possibly using an exception.