Hi,
I think this behaviour is ok. With client authentication the server does
an extended handshake. It checks the certificate of the client. So the
server must know the one from the client as well or it must trust the
certification authority which signed the client certificate.
How to solve the problem, depends on your environment. If you use only
Tomcat, no Apache-Webserver, you have to add the client certificate to
the jsse-stuff. You'll find additional info in the jsse-Dos and in the
docs to open-ssl. The last is usefull, if you are using apache in front
of tomcat.
Bernd
--
Dipl.-Inform. Bernd Koecke
UNIX-Entwicklung
Schlund+Partner AG
Fon: +49-721-91374-0
E-Mail: [EMAIL PROTECTED]
