How do I validate certificates using OpenAM-12.0

Question

I have the following use case:

1. A client sends its certificate to my portal.
2. My portal needs to authenticate the client based on the certificate.
3. The certificate sent by the client could be signed by a known Certificate Authority or could be signed by a Certificate Authority which is specific to the client's organization.
4. My portal would, in some way or other, be able to get the public key of the Certificate Authority if the client's certificate are signed by the client's organization.

Could you please suggest me ways to implement this use case using OpenAM?