1. some of the important attributes are not cloned, such as date.
2. The clone operation should look like:
   copy.certStores = new ArrayList<CertStore>(certStores);
   copy.certPathCheckers = ...

    public Object clone() {
        try {
            Object copy = super.clone();
            // Must clone these because addCertStore, et al. modify them
            if (certStores != null) {
                certStores = new ArrayList<CertStore>(certStores);
            }
            if (certPathCheckers != null) {
                certPathCheckers =
                        new ArrayList<PKIXCertPathChecker>(certPathCheckers);
            }
            return copy;
        } catch (CloneNotSupportedException e) {
            /* Cannot happen */
            throw new InternalError(e.toString());
        }
    }

CrlRevocationChecker.java uses the method.