code: @Override
      public X509Certificate[] extract(final HttpServletRequest request) {
          val certHeaderValue = getCertFromHeader(request);
          if (StringUtils.isBlank(certHeaderValue)) {
              LOGGER.debug("No header [{}] found in request (or value was null)", sslClientCertHeader);
              return null;
          }
  
          if (certHeaderValue.length() < X509_HEADER.length()) {
              LOGGER.debug("Header [{}] found but it is too short to parse. Header value: [{}]", sslClientCertHeader, certHeaderValue);
              return null;
          }
  
          val body = sanitizeCertificateBody(certHeaderValue);
          try (InputStream input = new ByteArrayInputStream(body.getBytes(StandardCharsets.ISO_8859_1))) {
              val cert = CertUtils.readCertificate(input);
              LOGGER.debug("Certificate extracted from header [{}] with subject: [{}]", sslClientCertHeader, cert.getSubjectDN());
              return new X509Certificate[]{cert};
          } catch (final Exception e) {
              LOGGER.warn("Error parsing the certificate in header: [{}] value: [{}] with error msg: [{}]", sslClientCertHeader, body, e.getMessage());
              LOGGER.debug("Error parsing the certificate in header: [{}] value: [{}]", sslClientCertHeader, body, e);
          }
          return null;
      }
docs: Extract base64 encoded certificate from header and convert to {@link X509Certificate}.
  Known behaviors of reverse proxies that are handled by the processing below:
  - mod_header converts the '\n' into ' ' - nginx converts the '\n' into
  multiple ' '
  The code assumes that the trimmed header value starts with '-----BEGIN
  CERTIFICATE-----' and ends with '-----END CERTIFICATE-----'.
  Note: For Java 7, the the BEGIN and END markers must be on separate lines as
  must each of the original content lines. The CertificateFactory is tolerant
  of any additional whitespace such as leading and trailing spaces and new
  lines as long as they do not appear in the middle of an original content
  line.