title: How is the SSL client certificate chosen when there are multiple matching certificates?
body: <p>It's not something that should happen by design, but for security concerns, i'm wondering how will the "right" certificate be sent to the server, assuming there are more than one certificates matching the requirement of being signed by a certain CA?</p>
  
  <p>I'm using a simple SSL JAVA example client, connecting to an Apache HTTPD.</p>
  
  <p>I tried testing with 4 certificates, each time deleting the chosen one and noting who was chosen next. I couldn't find a reasonable logic (i.e. date, alias name etc.) other than maybe a lexicographic order of the "sha256" of the certificates. that seems unlikely to me...</p>
  
  <p>The example client does something like</p>
  
  <pre><code>System.setProperty("javax.net.ssl.keyStore","device.p12");  
  System.setProperty("javax.net.ssl.keyStorePassword","password");  
  System.setProperty("javax.net.ssl.keyStoreType", "PKCS12");  
  System.setProperty("javax.net.ssl.trustStore","truststore.jks");  
  System.setProperty("javax.net.ssl.trustStorePassword","password");  
  SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();  
  SSLSocket sslSock = (SSLSocket) factory.createSocket("87.69.60.100",443);  
  BufferedWriter wr = new BufferedWriter(new OutputStreamWriter(sslSock.getOutputStream(), "UTF8"));  
  wr.write("GET /lather HTTP/1.1\r\nhost: 87.69.60.100\r\n\r\n");  
  wr.flush();  
  </code></pre>
  
  <p>And the Apache is configured with  </p>
  
  <pre><code>SSLCACertificateFile rootCA.crt  
  SSLVerifyClient require  
  </code></pre>
  
  <p>I couldn't find the relevant documentation to answer the question. I'm also wondering- is there any chance that the Apache will somehow forward more than one certificates chains? (say with a misbehaving client sending something weird).</p>
  
  <p>Thanks!</p>