title: tomcat 8 ssl require client authentication does not prevent access
body: <p>My goal is to increase my test server security by requiring the server to demand a client certificate.</p>
  
  <p>Tomcat server.xml (conf/server.xml) contains:</p>
  
  <pre><code>&lt;Connector
         protocol="org.apache.coyote.http11.Http11NioProtocol"
         scheme="https" secure="true" SSLEnabled="true"
         port="443"
         clientAuth="true"
         keyAlias="posh"
         maxThreads="200" acceptCount="100"
         minSpareThreads="5" maxSpareThreads="75"
         keystoreFile="conf/keystore.jks"
         keystoreType="JKS" keystorePass="somePassword"
         enableLookups="true" disableUploadTimeout="true"
         truststoreFile="conf/keystore.jks"
         truststoreType="JKS" truststorePass="somePassword"
         SSLVerifyClient="require" SSLEngine="on" SSLVerifyDepth="2"
         sslProtocol="TLS"/&gt;
  </code></pre>
  
  <p>Tomcat web.xml (conf/web.xml) contains:</p>
  
  <pre><code>&lt;web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
                        http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
    version="3.1"&gt;
  ...
  &lt;user-data-constraint&gt;
    &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
  &lt;/user-data-constraint&gt;
  &lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
          &lt;web-resource-name&gt;Everything&lt;/web-resource-name&gt;
          &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;user-data-constraint&gt;
          &lt;transport-guarantee&gt;CONFIDENTIAL&lt;/transport-guarantee&gt;
      &lt;/user-data-constraint&gt;
  &lt;/security-constraint&gt;
  &lt;login-config&gt;
      &lt;auth-method&gt;CLIENT-CERT&lt;/auth-method&gt;
  &lt;/login-config&gt;
  ...
  &lt;/web-app&gt;
  </code></pre>
  
  <p>No errors appear in my catalina log:</p>
  
  <blockquote>
    <p>... 26-Jan-2016 15:29:59.023 INFO [main]
    org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler
    ["http-nio-8080"] 26-Jan-2016 15:29:59.420 INFO [main]
    org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler
    ["http-nio-443"] 26-Jan-2016 15:29:59.421 INFO [main]
    org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler
    ["ajp-nio-8009"] 26-Jan-2016 15:29:59.422 INFO [main]
    org.apache.catalina.startup.Catalina.start Server startup in 24056 ms</p>
  </blockquote>
  
  <p>Not sure if this matters at this point, but the conf/keystore.jks yields the following list:</p>
  
  <pre><code>root@Posh:/opt/tomcat/conf# keytool -list -keystore keystore.jks -storepass somePassword
  
  Keystore type: JKS
  Keystore provider: SUN
  
  Your keystore contains 2 entries
  
  posh, Jan 26, 2016, PrivateKeyEntry, 
  Certificate fingerprint (SHA1): 0F:DA:1D:B3:5C:37:60:D0:46:8B:7C:DE:F3:96:2E:DE:A2:4E:2F:B5
  clientcert, Jan 26, 2016, trustedCertEntry, 
  Certificate fingerprint (SHA1): 42:16:28:7E:17:2D:6C:B4:61:F4:8D:DA:B7:6E:90:E4:9F:3E:FC:83
  </code></pre>
  
  <p>My Tomcat 8 configuration is otherwise out-of-box running as tomcat user on Ubuntu 14.04 under authbind().</p>
  
  <p>A client connecting to the site can accept the server certificate and freely access all deployed application without an client certificate.</p>
  
  <p>I was hoping that Tomcat would "require" a client certificate from every client before allowing access to applications.</p>
  
  <p>How can I change the configuration to require/demand a client certificate to access any/all applications on the site?</p>