code: protected String[] extractClientCertificateChain(HttpServletRequest request)
      {
          for (ClientCertificateExtractor extractor : clientCertificateExtractors)
          {
              String[] chain = extractor.extractClientCertificateChain(request);
              if (chain != null && chain.length > 0)
              {
                  return chain;
              }
          }
  
          return null;
      }
docs: Utility method for extracting a single client certificate from the default
  certificate extractors. First checks the request itself for an attached
  certificate using {@link javax.servlet.request.X509Certificate}, then
  checks the incoming request headers for reverse-proxied certificates
  using default headers.
  
  @see ClientCertificateExtractor
  
  @param request
  The incoming HTTP request to search for the client's certificate.
  
  @return
  The client's mutual TLS certificate.
  
  @since 2.8