title: Tomcat client certificate authentication, client certificate not sent
body: <p>I've add client certificate based authentication on our Tomcat servers.
  Both client and server are tomcat servers with internal CA issued certificates.</p>
  
  <p>Each tomcat has its own keystore (PKCS12) containing its private key and certificate and a truststore (JKS) containing the CA public certifiacte.</p>
  
  <p>After stating the Tomcat server for the first time, the authentication fails (results in 403).
  Upon restarting the tomcat, the authentication is successful.
  I've enabled debugging on the SSL and I've noticed that when the authentication fails, the client does not send its certificate but after restarting it does.</p>
  
  <p>No errors appear in the log files.</p>
  
  <p>Failed authentication log:</p>
  
  <pre><code>*** CertificateRequest
  Cert Types: RSA, DSS, ECDSA
  Cert Authorities:
  &lt;EMAILADDRESS=x@x.com, CN=x.x.x, OU=x, O=x., L=x, ST=x, C=x&gt;
  *** ServerHelloDone
  *** Certificate chain
  ***
  *** Found trusted certificate:
  </code></pre>
  
  <p>Succesful authentication log:</p>
  
  <pre><code>*** CertificateRequest
  Cert Types: RSA, DSS, ECDSA
  Cert Authorities:
  &lt;EMAILADDRESS=x@x.com, CN=x.x.x, OU=x, O=x., L=x, ST=x, C=x&gt;
  *** ServerHelloDone
  matching alias: tomcat
  *** Certificate chain
  chain [0] = [
  </code></pre>
  
  <p>Any idea of what's causing it to work on the second try?
  Nothing changes on the tomcat servers...</p>
  
  <p>Thanks</p>