title: Should the client have the same keystore as the server?
body: <p>I am reading about the best way to create a secure connection between a client and a server.</p>
  
  <p>Through <a href="http://stilius.net/java/java_ssl.php" rel="nofollow noreferrer">this tutorial</a> it seems that the certificate (and the keystore) is not only given to the server, but it is also given to the client.</p>
  
  <p>Isn't this insecure? If the client has the certificate file (in the keystore), won't it have all the server private keys?</p>
  
  <p>In the end what I want is to have a secure/encrypted connection between the client and the server, while the client itself proving to the server that it is an authentic client. Is this the right way to go?</p>
  
  <p>Thanks!</p>