title: Tomcat SSL Working When It Shouldn't
body: <p>I am trying to do a simple test of SSL on Tomcat. I added the following to my <strong>server.xml</strong>:</p>
  
  <pre><code>&lt;Connector port="8444"
    protocol="HTTP/1.1"
    SSLEnabled="true"
    maxThreads="150"
    scheme="https"
    secure="true"
    clientAuth="false"
    sslProtocol="TLS"
    keystoreFile="&lt;path to my .jks file&gt;"
    keystorePass="&lt;pass to my .jks file&gt;" /&gt;
  </code></pre>
  
  <p>The keystore was generated using the following: </p>
  
  <pre><code>keytool -genkey -alias MyKeyStore -keyalg RSA -keystore &lt;path to my .jks file&gt;
  </code></pre>
  
  <p>Now, after doing this, I am able to use SoapUI to make a request to localhost:8444/ and hit a breakpoint in my web service. <strong>This is not what I was expecting.</strong> Per my understanding, SoapUI should also need to know about the keystore to validate the server's certificate. Otherwise, anyone can call the service, which defeats the purpose of SSL / HTTPS. Furthermore, shouldn't SoapUI also have a certificate / keystore which the server validates?</p>
  
  <p>I am trying to do this so I can figure out how to write a java client that authenticates correctly to a web service set up behind SSL, but based on what I am seeing, I haven't set up the web service correctly, so I can't move on to the next step.</p>
  
  <p>Apologies in advance if there is something basic I am misunderstanding about SSL / HTTPS. This is my first time working with it.</p>
  
  <p><strong>Summary: Why is SoapUI allowed to send a request over SSL / HTTPS without having any information about the web service's certificate / keystore? How can I set up Tomcat so that only clients which know about my certificate can send requests?</strong></p>