[snip]

[snip]

Hi,
It's probably impossible to do exactly what you want. You see, WWW
authentication (basic or digest) via username/password is performed
at the HTTP level of request and response headers. Client certificate
authentication (which can only be done over HTTPS) actually happens
at the SSL level. The connection is established, and the server
demands a client certificate (and checks it) before even allowing the
browser to transmit the request. The server doesn't even know what
URL is going to be requested when it demands the certificate, which
is why the servlet can't possibly handle this case. The server
probably provides some way for your servlet to access various pieces
of the certificate once it starts running (i.e. the subject DN and so
on stored in environment variables or something), but that's too late
for verifying the certificate. If you're trying to make a site
that'll allow the general public to use certificate auth with their
own certificates, your best bet is to load as many CA certificates
into your server as you can find and hope for the best. If you're
doing a private system, it's much easier, as you can just make sure
the one CA that issues all the user certs is loaded in the server. Of
course, for the general-public version, the server simply checks that
the client certificate is valid (i.e. descended from a CA); it
doesn't actually check *who* the cert belongs to unless you add more
configuration. That part could perfectly well be done by the servlet
instead.

Good luck anyway :)
Chris