class X509AuthenticationFilter extends AuthenticatingFilter {

    @Override
    protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
        X509Certificate[] clientCertChain = CertUtils.extractCert(request, useHeader);

        if (clientCertChain == null || clientCertChain.length < 1) {
            throw new ShiroException("Request do not contain any X509Certificate ");
        }

        return new X509AuthenticationToken(clientCertChain, getHost(request));
    }

}