[jaxrs-dev] SeBootstrap.SSLClientAuthentication Clarification

[James Perkins <jperkins@xxxxxxxxxx>]

Hello All,

I'm trying to understand the usage of SSLClientAuthentication. The 3 options are NONE, OPTIONAL and MANDATORY. There is nothing in the specification about it, but the JavaDoc says:

"Secure socket client authentication policy

This policy is used in secure socket handshake to control whether the server requests client authentication, and whether successful client authentication is mandatory (i. e. connection attempt will fail for invalid clients)."

What I don't really understand is what is the use-case for an invalid client certificate? It seems a bit odd to me to allow invalid client certs, but I might just be missing some use-case.

--

James R. Perkins

JBoss by Red Hat