title: getAttribute("javax.servlet.request.X509Certificate") not set (Spring,CXF,Jetty,JAX-RSv1.1)
body: <p>My client implements Two-Way SSL in the following way:</p>
  
  <pre>
  
      private final static String KEYSTORE = "/security/client.jks";
      private final static String KEYSTORE_PASSWORD = "secret";
      private final static String KEYSTORE_TYPE = "JKS";
      private final static String TRUSTSTORE = "/security/certificates.jks";
      private final static String TRUSTSTORE_PASSWORD = "secret";
      private final static String TRUSTSTORE_TYPE = "JKS";
      ...
      KeyStore keystore = KeyStore.getInstance(KEYSTORE_TYPE);
      FileInputStream keystoreInput = new FileInputStream(new File(KEYSTORE));
      keystore.load(keystoreInput, KEYSTORE_PASSWORD.toCharArray());
      KeyStore truststore = KeyStore.getInstance(TRUSTSTORE_TYPE);
      FileInputStream truststoreIs = new FileInputStream(new File(TRUSTSTORE));
      truststore.load(truststoreIs, TRUSTSTORE_PASSWORD.toCharArray());
      SSLSocketFactory socketFactory = new SSLSocketFactory(keystore, KEYSTORE_PASSWORD, truststore);
      Scheme scheme = new Scheme("https", 8543, socketFactory);
      SchemeRegistry registry = new SchemeRegistry();
      registry.register(scheme);
      ClientConnectionManager ccm = new PoolingClientConnectionManager(registry);
      httpclient = new DefaultHttpClient(ccm);
      HttpResponse response = null;
      HttpGet httpget = new HttpGet("https://mylocalhost.com:8543/test");
      response = httpclient.execute(httpget);
      ...
  
  </pre>
  
  <p>And I try to retrieve the X.509 certificate on the server's side from the client via javax.servlet.http.HttpServletRequest.getAttribute("javax.servlet.request.X509Certificate") as it is decribed here: <a href="http://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/ServletRequest.html#getAttribute%28java.lang.String%29" rel="noreferrer">http://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/ServletRequest.html#getAttribute%28java.lang.String%29</a>.</p>
  
  <p>I get the HttpServletRequest on the server's side via:<br>
  HttpServletRequest servletRequest = (HttpServletRequest) msg.get("HTTP.REQUEST"); via the handleMessage(Message msg) method of my interceptor class which extends AbstractPhaseInterceptor&lt;Message&gt;. I have to use JAX-RS 1.1.1 on the server's side because of some Maven dependencies which I am not allowed to change and so I cannot use ContainerRequestFilter (supported from JAX-RS 2.0 on).</p>
  
  <p>My problem is that getAttribute("javax.servlet.request.X509Certificate") on the server's side returns null all the time. If I verify the traffic between server and client, I can see that the certificate from the server is sent to the client, that handshake works. But I cannot see that the client certificate is sent to the server and I think it is the reason why <code>getAttribute("javax.servlet.request.X509Certificate")</code> returns <code>null</code>. Does someone know how I can solve that problem? I tried some other implementations on the client's side already, but with no change.</p>
  
  <p>What am I doing wrong? Many thanks in advance!</p>
  
  <p>Additional information: I have seen on the server's side that javax.servlet.request.ssl_session_id, javax.servlet.request.key_size and javax.servlet.request.cipher_suite are set, but the key javax.servlet.request.X509Certificate is not set. I'm using Jetty Server 8.1.15, Apache CXF 2.7.x and JAX-RS 1.1.1. I tried with Jetty configuration via <a href="http://cxf.apache.org/docs/jetty-configuration.html" rel="noreferrer">http://cxf.apache.org/docs/jetty-configuration.html</a> and <a href="http://cxf.apache.org/docs/secure-jax-rs-services.html#SecureJAX-RSServices-Configuringendpoints" rel="noreferrer">http://cxf.apache.org/docs/secure-jax-rs-services.html#SecureJAX-RSServices-Configuringendpoints</a>, the attribute still isn't set.</p>