This is perhaps a newbie question, but I'm trying to get access to the
requestor's credentials in a servlet under Tomcat.

I use req.isSecure to ensure that I'm in a secure connection, and try to
get the certificates with:

X509Certificate[] certs
=(X509Certificate[])req.getAttribute("javax.servlet.request.X509Certificate");

With the default setting of clientAuth="false" in Tomcat, the above
always returns null;

Setting clientAuth to "true" returns the certificates.

However, I need clientAuth to be "false" for client browser access to
other servlets - is there any other way to get the certificate
information from Tomcat?  (All I need is the Public Key).

Thanks for any assistance.  Of course this is coming at a critical time.

Bill