private String getCertFromHeader(final HttpServletRequest request) {
        val certHeaderValue = request.getHeader(sslClientCertHeader);
        if (StringUtils.isBlank(certHeaderValue)) {
            return null;
        }

        if ("(null)".equalsIgnoreCase(certHeaderValue)) {
            return null;
        }
        return StringUtils.trim(certHeaderValue);
    }
Get certificate from header or return null.
HTTPD mod_header writes "(null)" when the ssl variable is not filled
so that is treated as if the header were not present or blank.

@param request HTTP request object
@return Base64 encoded certificate
support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/RequestHeaderX509CertificateExtractor.java