Method invoke

java/org/apache/catalina/valves/SSLValve.java:214–282

(Request request, Response response)

    @Override
    public void invoke(Request request, Response response) throws IOException, ServletException {
        /*
         * Known behaviours of reverse proxies that are handled by the processing below: - mod_header converts the '\n'
         * into ' ' - nginx converts the '\n' into multiple ' ' - nginx ssl_client_escaped_cert uses "uri component"
         * escaping, keeping only ALPHA, DIGIT, "-", ".", "_", "~"
         *
         * The code assumes that the trimmed header value starts with '-----BEGIN CERTIFICATE-----' and ends with
         * '-----END CERTIFICATE-----'.
         *
         * Note: As long as the BEGIN marker and the rest of the content are on separate lines, the CertificateFactory
         * is tolerant of any additional whitespace.
         */
        String headerValue;
        String headerEscapedValue = mygetHeader(request, sslClientEscapedCertHeader);
        if (headerEscapedValue != null) {
            headerValue = UDecoder.URLDecode(headerEscapedValue, null);
        } else {
            headerValue = mygetHeader(request, sslClientCertHeader);
        }
        if (headerValue != null) {
            headerValue = headerValue.trim();
            if (headerValue.length() > 27) {
                String body = headerValue.substring(27);
                String header = "-----BEGIN CERTIFICATE-----\n";
                String strcerts = header.concat(body);
                ByteArrayInputStream bais = new ByteArrayInputStream(strcerts.getBytes(StandardCharsets.ISO_8859_1));
                X509Certificate[] jsseCerts = null;
                String providerName = (String) request.getConnector().getProperty("clientCertProvider");
                try {
                    CertificateFactory cf;
                    if (providerName == null) {
                        cf = CertificateFactory.getInstance("X.509");
                    } else {
                        cf = CertificateFactory.getInstance("X.509", providerName);
                    }
                    X509Certificate cert = (X509Certificate) cf.generateCertificate(bais);
                    jsseCerts = new X509Certificate[1];
                    jsseCerts[0] = cert;
                } catch (java.security.cert.CertificateException e) {
                    log.warn(sm.getString("sslValve.certError", strcerts), e);
                } catch (NoSuchProviderException e) {
                    log.error(sm.getString("sslValve.invalidProvider", providerName), e);
                }
                request.setAttribute(Globals.CERTIFICATES_ATTR, jsseCerts);
            }
        }
        headerValue = mygetHeader(request, sslSecureProtocolHeader);
        if (headerValue != null) {
            request.setAttribute(Globals.SECURE_PROTOCOL_ATTR, headerValue);
        }
        headerValue = mygetHeader(request, sslCipherHeader);
        if (headerValue != null) {
            request.setAttribute(Globals.CIPHER_SUITE_ATTR, headerValue);
        }
        headerValue = mygetHeader(request, sslSessionIdHeader);
        if (headerValue != null) {
            request.setAttribute(Globals.SSL_SESSION_ID_ATTR, headerValue);