private void validateSslConnection(ChannelHandlerContext ctx) throws Exception {
    if (http2PeerCertificateSanRegex.trim().isEmpty()) {
      return;
    }
    SslHandler sslHandler = ctx.channel().pipeline().get(SslHandler.class);
    if (sslHandler == null) {
      return;
    }
    sslHandler.handshakeFuture().addListener(future -> {
      if (!future.isSuccess()) {
        logger.error("SSL handshake failed for channel: {}", ctx.channel(), future.cause());
        return;
      }
      try {
        SSLSession sslSession = sslHandler.engine().getSession();
        Certificate[] peerCertificates = sslSession.getPeerCertificates();
        for (Certificate cert : peerCertificates) {
          if (cert instanceof X509Certificate) {
            X509Certificate x509Certificate = (X509Certificate) cert;
            Principal p = x509Certificate.getSubjectDN();

            Collection<?> subjectAltNames = x509Certificate.getSubjectAlternativeNames();
            if (subjectAltNames == null) {
              continue;
            }
            int numSanName = 0;
            for (Object subjectAltName : subjectAltNames) {
              numSanName++;
              List<?> entry = (List<?>) subjectAltName;
              if (entry == null || entry.size() < 2) {
                continue;
              }
              Integer altNameType = (Integer) entry.get(0);
              String altName = (String) entry.get(1);
              if (altNameType == null || altName == null) {
                continue;
              }

              if (http2PeerCertificateSanRegexPattern.matcher(altName).matches()) {
                return;
              }
            }
          }
        }
      } catch (Exception e) {
        logger.error("Exception thrown, peer certificate validation failed for channel: {}", ctx.channel(), e);
      }
      logger.error("Peer certificate validation failed for channel: {}", ctx.channel());
      http2ClientMetrics.http2ServerCertificateValidationFailureCount.inc();
      ctx.channel().close();
    });
  }
Listen to the handshake future for the SSL termination, then apply the security policies, potentialy closing the
connection in case security check fails.
@param ctx the {@link ChannelHandlerContext}.
ambry-network/src/main/java/com/github/ambry/network/http2/Http2PeerCertificateValidator.java