This assumes you have reviewed Getting Started with IBM Global Security Key (GSKit).

The GSKit command line tool with the -validate flag can be used to determine if one or all of the certificates in a Key Database are valid.

~]# ${install_root}/gsk8/bin/gsk8capicmd_64 -cert -validate -db /path/to/example.kdb -stashed
my_root_ca : OK
my_intermediate_certificate : OK
my_server_certificate : OK

Or, a specific certificate can be validated.

~]# ${install_root}/gsk8/bin/gsk8capicmd_64 -cert -validate -db /path/to/example.kdb -stashed -abel my_root_ca
my_root_ca : OK