code: private String getIssuerHashHeader(final DmfTenantSecurityToken secruityToken, final String knownIssuerHashes) {
          // there may be several knownIssuerHashes configured for the tenant
          final List<String> knownHashes = splitMultiHashBySemicolon(knownIssuerHashes);
  
          // iterate over the headers until we get a null header.
          int iHeader = 1;
          String foundHash;
          while ((foundHash = secruityToken.getHeader(String.format(sslIssuerHashBasicHeader, iHeader))) != null) {
              if (knownHashes.contains(foundHash.toLowerCase())) {
                  if (LOGGER.isTraceEnabled()) {
                      LOGGER.trace("Found matching ssl issuer hash at position {}", iHeader);
                  }
                  return foundHash.toLowerCase();
              }
              iHeader++;
          }
          LOG_SECURITY_AUTH.debug(
                  "Certifacte request but no matching hash found in headers {} for common name {} in request",
                  sslIssuerHashBasicHeader, secruityToken.getHeader(caCommonNameHeader));
          return null;
      }
docs: Iterates over the {@link #sslIssuerHashBasicHeader} basic header
  {@code X-Ssl-Issuer-Hash-%d} and try to finds the same hash as known.
  It's ok if we find the the hash in any the trusted CA chain to accept
  this request for this tenant.