title: Client authentication with HttpClient
body: <p>Trying to implement client key authentication (with self signed ca).</p>
  
  <p>Code looks like:</p>
  
  <pre><code>KeyStore keyStore = KeyStore.getInstance("PKCS12");
  keyStore.load(new FileInputStream("client.p12"), "changeit".toCharArray())
  
  SSLContext sslcontext = SSLContexts.custom()
              .loadTrustMaterial(null, new TrustSelfSignedStrategy()) //DONT DO THAT, IT'S JUST TO SIMPLIFY THIS EXAMPLE. USE REAL TrustStore WITH REAL SERVER CERTIFICATE IMPORTED. DONT TRUST SELF SIGNED
              .loadKeyMaterial(keyStore, "changeit".toCharArray())
              .build();
  socketFactory = new SSLConnectionSocketFactory(
              sslcontext,
              new String[] {"TLSv1.2", "TLSv1.1"},
              null,
              new NoopHostnameVerifier()
  );
  HttpClient httpclient = HttpClients.custom()
              .setSSLSocketFactory(socketFactory)
              .build();
  </code></pre>
  
  <p>With <code>-Djavax.net.debug=all</code> I can see it correctly chooses my certificate, i see signatures, I see certificate request, and there ECDHClientKeyExchange, etc, all looks fine. </p>
  
  <p>But anyway I'm getting following response from Nginx (with status 400):</p>
  
  <pre><code>&lt;head&gt;&lt;title&gt;400 The SSL certificate error&lt;/title&gt;&lt;/head&gt;
  </code></pre>
  
  <p>Notice, that for incorrect certificate/key nginx usually drops session, w/o providing any details in plain text response.</p>
  
  <p>This <code>client.p12</code> works from command line, like:</p>
  
  <pre><code>$ curl -ivk --cert client.p12:changeit https://192.168.1.1
  
  
  * Rebuilt URL to: https://192.168.1.1/
  *   Trying 192.168.1.1...
  * Connected to 192.168.1.1 (192.168.1.1) port 443 (#0)
  * WARNING: SSL: Certificate type not set, assuming PKCS#12 format.
  * Client certificate: client-es.certs.my
  * TLS 1.2 connection using TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  * Server certificate: server.certs.my
  * Server certificate: ca.my
  &gt; GET / HTTP/1.1
  &gt; Host: 192.168.1.1
  &gt; User-Agent: curl/7.43.0
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 200 OK
  </code></pre>
  
  <p>So this key is definitely valid. But why it doesn't work for Java? Is there're anything i've missed in java ssl config?</p>