title: How Chrome browser know which client certificate to prompt for a site?
body: <p>I'm setting up certificate authentication for my project using Tomcat. It works ok for command line client such as cURL.</p>
  
  <p>I have many client certificates installed in Chrome browser. Some are using to connect to my site, others are used for different purposes and not relate to my project.</p>
  
  <p>Every time I connect to my site, Chrome presents a list of client certificates for choosing. These are exactly the certificates that I installed and not others. My questions are:</p>
  
  <ol>
  <li>How Chrome knows which client certificates are for a site to present for choosing?</li>
  <li>Tomcat stores those client certificates in its trust store. During
  SSL hanshake, Tomcat will request for client certificate. Does it
  request for some specific certificates that it knows in its trusted
  store so that Chrome knows what to show?</li>
  </ol>