private static List<Client> parseClients(CloudDataPlaneFilterConfig cfg) {
        Set<String> ids = new HashSet<>();
        List<Client> clients = new ArrayList<>(cfg.clients().size());
        if (cfg.clients().isEmpty()) throw new IllegalArgumentException("Empty clients configuration");
        for (var c : cfg.clients()) {
            if (ids.contains(c.id()))
                throw new IllegalArgumentException("Clients definition has duplicate id '%s'".formatted(c.id()));
            if (c.certificates().isEmpty())
                throw new IllegalArgumentException("Client '%s' has no certificate configured".formatted(c.id()));
            ids.add(c.id());
            List<X509Certificate> certs;
            try {
                certs = c.certificates().stream()
                        .flatMap(pem -> X509CertificateUtils.certificateListFromPem(pem).stream()).toList();
            } catch (Exception e) {
                throw new IllegalArgumentException(
                        "Client '%s' contains invalid X.509 certificate PEM: %s".formatted(c.id(), e.toString()), e);
            }
            if (certs.isEmpty()) throw new IllegalArgumentException(
                    "Client '%s' certificate PEM contains no valid X.509 entries".formatted(c.id()));
            clients.add(new Client(c.id(), Permission.setOf(c.permissions()), certs));
        }
        log.fine(() -> "Configured clients with ids %s".formatted(ids));
        return clients;
    }
Data plane filter for Cloud
<p>
Legacy mode is the original mode of configuring mTLS where <code>&lt;clients&gt;</code> is not configured in services.xml
and trusted certificate authorities are listed in <code>security/clients.pem</code>.
</p>

@author bjorncs
jdisc-security-filters/src/main/java/com/yahoo/jdisc/http/filter/security/cloud/CloudDataPlaneFilter.java