private void sendConnectionHeaderResponseIfNeeded() throws FatalConnectionException {
    Pair<RPCProtos.ConnectionHeaderResponse, CryptoAES> pair = setupCryptoCipher();
    // Response the connection header if Crypto AES is enabled
    if (pair == null) {
      return;
    }
    try {
      int size = pair.getFirst().getSerializedSize();
      BufferChain bc;
      try (ByteBufferOutputStream bbOut = new ByteBufferOutputStream(4 + size);
        DataOutputStream out = new DataOutputStream(bbOut)) {
        out.writeInt(size);
        pair.getFirst().writeTo(out);
        bc = new BufferChain(bbOut.getByteBuffer());
      }
      doRespond(new RpcResponse() {

        @Override
        public BufferChain getResponse() {
          return bc;
        }

        @Override
        public void done() {
          // must switch after sending the connection header response, as the client still uses the
          // original SaslClient to unwrap the data we send back
          saslServer.switchToCryptoAES(pair.getSecond());
        }
      });
    } catch (IOException ex) {
      throw new UnsupportedCryptoException(ex.getMessage(), ex);
    }
  }
Send the response for connection header
hbase-server/src/main/java/org/apache/hadoop/hbase/ipc/ServerRpcConnection.java