@Override
    public X509Certificate[] extract(final HttpServletRequest request) {
        val certHeaderValue = getCertFromHeader(request);
        if (StringUtils.isBlank(certHeaderValue)) {
            LOGGER.debug("No header [{}] found in request (or value was null)", sslClientCertHeader);
            return null;
        }

        if (Objects.requireNonNull(certHeaderValue).length() - X509_FOOTER.length() < X509_HEADER.length()) {
            LOGGER.debug("Header [{}] found but it is too short to parse. Header value: [{}]", sslClientCertHeader, certHeaderValue);
            return null;
        }

        LOGGER.trace("Located value [{}] from header [{}]. Parsing...", certHeaderValue, sslClientCertHeader);
        val body = sanitizeCertificateBody(certHeaderValue);
        LOGGER.debug("Certificate body to parse is [{}]", body);

        try (val input = new ByteArrayInputStream(body.getBytes(StandardCharsets.ISO_8859_1))) {
            val cert = CertUtils.readCertificate(input);
            LOGGER.debug("Certificate extracted from header [{}] with subject: [{}]", sslClientCertHeader, cert.getSubjectDN());
            return new X509Certificate[]{cert};
        } catch (final Exception e) {
            LOGGER.debug("Could not parse certificate from header: [{}] with sanitized value: [{}]", sslClientCertHeader, body);
            LoggingUtils.warn(LOGGER, e);
        }
        return null;
    }
Extract base64 encoded certificate from header and convert to {@link X509Certificate}.
Known behaviors of reverse proxies that are handled by the processing below:
- mod_header converts the '\n' into ' ' - nginx converts the '\n' into
multiple ' '
The code assumes that the trimmed header value starts with '-----BEGIN
CERTIFICATE-----' and ends with '-----END CERTIFICATE-----'.
Note: For Java 7, the BEGIN and END markers must be on separate lines as
must each of the original content lines. The CertificateFactory is tolerant
of any additional whitespace such as leading and trailing spaces and new
lines as long as they do not appear in the middle of an original content
line.
support/cas-server-support-x509-core/src/main/java/org/apereo/cas/adaptors/x509/authentication/RequestHeaderX509CertificateExtractor.java