private final static String KEYSTORE = "/security/client.jks";
    private final static String KEYSTORE_PASSWORD = "secret";
    private final static String KEYSTORE_TYPE = "JKS";
    private final static String TRUSTSTORE = "/security/certificates.jks";
    private final static String TRUSTSTORE_PASSWORD = "secret";
    private final static String TRUSTSTORE_TYPE = "JKS";
    ...
    KeyStore keystore = KeyStore.getInstance(KEYSTORE_TYPE);
    FileInputStream keystoreInput = new FileInputStream(new File(KEYSTORE));
    keystore.load(keystoreInput,KEYSTORE_PASSWORD.@R_403_294@arArray());
    KeyStore truststore = KeyStore.getInstance(TRUSTSTORE_TYPE);
    FileInputStream truststoreIs = new FileInputStream(new File(TRUSTSTORE));
    truststore.load(truststoreIs,TRUSTSTORE_PASSWORD.@R_403_294@arArray());
    SSLSocketFactory socketFactory = new SSLSocketFactory(keystore,KEYSTORE_PASSWORD,truststore);
    Scheme scheme = new Scheme("https",8543,socketFactory);
    SchemeRegistry registry = new SchemeRegistry();
    registry.register(scheme);
    ClientConnectionManager ccm = new PoolingClientConnectionManager(registry);
    httpclient = new DefaultHttpClient(ccm);
    HttpResponse response = null;
    HttpGet httpget = new HttpGet("https://mylocalhost.com:8543/test");
    response = httpclient.execute(httpget);
    ...

我尝试通过javax.servlet.http.HttpServletRequest.getAttribute(“javax.servlet.request.X509Certificate”)从客户端检索服务器端的X.509证书,如下所述：http://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/ServletRequest.html#getAttribute%28java.lang.String%29.

我通过以下方式在服务器端获得HttpServletRequest：
HttpServletRequest servletRequest =(HttpServletRequest)msg.get(“HTTP.REQUEST”);通过我的拦截器类的handleMessage(Message msg)方法,它扩展了AbstractPhaseInterceptor< Message>.我必须在服务器端使用JAX-RS 1.1.1,因为我不允许更改一些Maven依赖项,所以我不能使用ContainerRequestFilter(从JAX-RS 2.0支持).

我的问题是服务器端的getAttribute(“javax.servlet.request.X509Certificate”)一直返回null.如果我验证服务器和客户端之间的流量,我可以看到来自服务器的证书被发送到客户端,该握手有效.但我看不到客户端证书被发送到服务器,我认为这是getAttribute(“javax.servlet.request.X509Certificate”)返回null的原因.有人知道如何解决这个问题吗？我已经在客户端尝试了其他一些实现,但没有任何改变.

我究竟做错了什么？提前谢谢了！

附加信息：我在服务器端看到设置了javax.servlet.request.ssl_session_id,javax.servlet.request.key_size和javax.servlet.request.cipher_suite,但未设置密钥javax.servlet.request.X509Certificate .我正在使用Jetty Server 8.1.15,Apache CXF 2.7.x和JAX-RS 1.1.1.我尝试通过http://cxf.apache.org/docs/jetty-configuration.html和http://cxf.apache.org/docs/secure-jax-rs-services.html#SecureJAX-RSServices-Configuringendpoints进行Jetty配置,但属性仍未设置.