@Override
    public List<Credential> fromRequest(final HttpServletRequest request, final MultiValueMap<String, String> requestBody) {
        val certFromHeader = certificateExtractor.extract(request);
        if (certFromHeader != null) {
            LOGGER.debug("Certificate found in HTTP request via [{}]", certificateExtractor.getClass().getName());
            val credentials = new ArrayList<Credential>(1);
            credentials.add(prepareCredential(request, new X509CertificateCredential(certFromHeader)));
            return credentials;
        }
        return new ArrayList<>();
    }
This is {@link X509RestHttpRequestHeaderCredentialFactory} that attempts to
extract the certificate from the request, using {@link X509CertificateExtractor}
to locate and construct X509 credentials. If the request does not contain a
certificate, it will then fallback onto the default behavior of capturing
credentials.

@author Curtis Ruck
@since 6.0.0
support/cas-server-support-rest-x509/src/main/java/org/apereo/cas/support/x509/rest/X509RestHttpRequestHeaderCredentialFactory.java