title: MTLS and http client connection pool usage
body: <p><strong>Background</strong></p>
  <ul>
  <li>I am required to connect to a server for various clients.</li>
  <li>Each client connection should use a unique TLS cert.</li>
  <li>MTLS is in place on the server.</li>
  <li>I want to use connection pooling to improve latency.</li>
  </ul>
  <p>Using the following http client</p>
  <pre><code>&lt;dependency&gt;
     &lt;groupId&gt;org.apache.httpcomponents&lt;/groupId&gt;
     &lt;artifactId&gt;httpclient&lt;/artifactId&gt;
     &lt;version&gt;4.5.12&lt;/version&gt;
  &lt;/dependency&gt;
  </code></pre>
  <p><strong>My Assumption</strong>
  When managing connections in the connection pool, when a connection is being selected the client certificate should be considered before selecting the same connection in the connection pool.
  I do not want connections for clientA using clientB TLS cert and vice versa.</p>
  <p><strong>Question</strong>
  Is this assumption true?</p>
  <p><strong>Scenario 1)</strong></p>
  <p>I have max connections per route set to 2.
  I make a call to the MTLS secured server for client A. (one connection in the pool)
  I make a call to the MTLS secured server for client A. (two connections in the pool)
  Should this not of reused the first connection?</p>
  <p><strong>Scenario 2)</strong></p>
  <p>I have max connections per route set to 2.
  I make a call to the MTLS secured server for client A. (one connection in the pool)
  I make a call to the MTLS secured server for client B. (two connections in the pool)</p>
  <p>However the second call does not seem to carry out a full handshake an is using clientA certificate.</p>
  <p>I would expect the second call to require a full handshake and the connections to be not related in anyway.</p>
  <p>Is this the expected behaviour? Am I missing something obvious here?</p>
  <p><strong>Updated simpler test case</strong></p>
  <p>We are now using the http context so I have attached the updated logs.
  I have simplified the test case too and now it connects to the same server twice each time it should use a different client certificate.</p>
  <p>The application is using spring boot and has a single restTemplate and single httpClient.</p>
  <p>Its using a PrivateKeyStrategy to decide what private key/certificate to use when communicating with the server.</p>
  <p>The first connection uses key alias 'e2e_transport_key_id_franek' (you will see this in the logs)</p>
  <p>The second connection should use alias 'e2e_transport_key_id_pdw' (never seen in the logs)</p>
  <p>The second connection we are making should use the key/cert with alias 'e2e_transport_key_id_pdw' however the session is resumed see line 448 Try resuming session. Which means we cannot use the PrivateKeyStrategy to pick the client certificate to use.</p>
  <p>How to force the client connection to not reuse the session for connections we intend to use a different client certificate for?</p>
  <p><em>client logs</em>
  <a href="https://pastebin.com/zN0EW3Qy" rel="nofollow noreferrer">https://pastebin.com/zN0EW3Qy</a></p>