private void logSSLInfo(ChannelHandlerContext ctx) {
    if (sslLogMessage == null) {
      sslLogMessage = new StringBuilder();
      sslLogMessage.append("SSL (");
      try {
        SslHandler sslHandler = ctx.pipeline().get(SslHandler.class);
        boolean sslUsed = sslHandler != null;
        sslLogMessage.append("[used=").append(sslUsed).append("]");
        structuredLogMessage.put("used", String.valueOf(sslUsed));

        if (sslUsed) {
          SSLEngine sslEngine = sslHandler.engine();
          if (sslEngine.getNeedClientAuth()) {
            for (Certificate certificate : sslEngine.getSession().getPeerCertificates()) {
              if (certificate instanceof X509Certificate) {
                X500Principal principal = ((X509Certificate) certificate).getSubjectX500Principal();

                sslLogMessage.append(", [principal=").append(principal).append("]");
                structuredLogMessage.put("principal", principal.toString());
                Collection<List<?>> subjectAlternativeNames =
                    ((X509Certificate) certificate).getSubjectAlternativeNames();
                if (subjectAlternativeNames != null && !subjectAlternativeNames.isEmpty()) {
                  /*
                   * https://docs.oracle.com/javase/7/docs/api/java/security/cert/X509Certificate.html#getSubjectAlternativeNames()
                   * For getSubjectAlternativeNames, a Collection is returned with an entry representing each GeneralName included in the extension.
                   * Each entry is a List whose first entry is an Integer (the name type, 0-8) and whose second entry is a String or a byte array.
                   * */
                  // here we filter out dns field and value, we don't need those values in public access log.
                  subjectAlternativeNames = subjectAlternativeNames.stream()
                      .filter(p -> (Integer) p.get(0) != SAN_DNS_FIELD_ID)
                      .collect(Collectors.toList());
                }
                sslLogMessage.append(", [san=").append(subjectAlternativeNames).append("]");
                structuredLogMessage.put("san", String.valueOf(subjectAlternativeNames));
              }
            }
          }
        }
      } catch (Exception e) {
        logger.error("Unexpected error while getting SSL connection info for public access logger", e);
      }
      sslLogMessage.append(")");
    }
    logMessage.append(sslLogMessage);
  }
If this is an SSL channel, log information about the peer certificate.
@param ctx the {@link ChannelHandlerContext} for this channel.
ambry-rest/src/main/java/com/github/ambry/rest/PublicAccessLogHandler.java