title: Apache HttpClient 4.3 and x509 client certificate to authenticate
body: <p>now I looking for solution regarding task how to rewrite deprecated solution for client side x509 certificate authentication via HttpComponentsMessageSender (not relevant).</p>
  
  <p>For example, deprecated solution is:</p>
  
  <pre><code>    SSLSocketFactory lSchemeSocketFactory = new SSLSocketFactory(this.keyStore, this.keyStorePassword);
      Scheme sch = new Scheme("https", 443, lSchemeSocketFactory);
  
      DefaultHttpClient httpClient = (DefaultHttpClient)getHttpClient();
      httpClient.getConnectionManager().getSchemeRegistry().register(sch);
  </code></pre>
  
  <p>As new solution with CloseableHttpClient I am using:</p>
  
  <pre><code>    SSLContextBuilder sslContextBuilder = SSLContexts.custom()
              // this key store must contain the key/cert of the client
              .loadKeyMaterial(keyStore, keyStorePassword.toCharArray());
  
      if (trustStore != null) {
          // this key store must contain the certs needed and trusted to verify the servers cert
          sslContextBuilder.loadTrustMaterial(trustStore);
      }
  
      SSLContext sslContext = sslContextBuilder.build();
  
      LayeredConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext);
  
      // Create a registry of custom connection socket factories for supported
      // protocol schemes / https
      Registry&lt;ConnectionSocketFactory&gt; socketFactoryRegistry = RegistryBuilder.&lt;ConnectionSocketFactory&gt;create()
              .register("https", sslsf)
              .register("http", new PlainConnectionSocketFactory())
              .build();
  
      PoolingHttpClientConnectionManager connPoolControl =
              new PoolingHttpClientConnectionManager(socketFactoryRegistry);
      setConnPoolControl(connPoolControl);
      getClientBuilder().setSSLSocketFactory(sslsf);
  </code></pre>
  
  <p>I still get 403 forbidden from server. But when I use "deprecated" version of the solution, it works great. SSL certificate is signed Thawte.</p>
  
  <p>Any idea?
  Thanks</p>