I considered this but one issue I encountered is that there's no common module between spray-io and spray-http. We'd need the `SSL-Session-Info` header to match I think.

With regards to the specific questions, my answers below are based on the JavaDoc of SSLSession. It's been many years since I've used a JSSE provider besides JRE and Bouncycastle so I don't know if other providers implement things per JavaDoc invariants.

> are principals always available?

The local principal is available if one was sent in the handshake. If using an X509 based cipher suite, the leaf certificate is returned and if using a Kerberos cipher suite, the `KerberosPrincipal` is returned. Based on this, I assume that the client side of an SSL session where the server does not request client authentication results in `session.getLocalPrincipal` returning null.

The `getPeerPrincipal` method returns the leaf certificate for an X509 based cipher suite and a `KerberosPrincipal` for a Kerberos cipher suite. If the peer's identity wasn't verified, an `SSLPeerUnverifiedException` is thrown.

Based on both of the above, I assume anonymous cipher suites (e.g., SSL_DH_anon_WITH_RC4_128_MD5) result in `getLocalPrincipal` returning null and `getPeerPrincipal` throwing. I'll test that.

So anyway, no, principals are not always available.

> what's the relation between principals and certificates? I'd say certificates provide evidence for the identity of a principal, right?

Yes, for certificate based cipher suites, the principal is just the leaf certificate. For non-certificate based cipher suites, `getLocalCertificates` returns null and `getPeerCertificates` throws `SSLPeerUnverifiedException`.

> do we know which cipher suites provide principals and certificates apart from Kerberos?

Not exhaustively -- supported cipher suites change in each Java release and custom JSSE providers can support different / additional ones.

So att the very least, we'd need to change `localPrincipal` and `peerPrincipal` to be `Option[Prinicpal]`. WDYT?