title: Enable Logging SSL handshake failure(Audit purpose logs) only on Tomcat 8+ with Java
body: <p>I need to log if a SSL handshake fails while a REST client tries to connect to my application. The application is build using Spring Boot and Java 8 and deployed on Tomcat 8. </p>
  
  <p>In the scenario of SSL handshake failing, since the TLS connection is broken, the logging requirement might have to be done in the Tomcat layer or Java, since Tomcat is using underlying JVM for SSL certificate validation in my case.</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true" scheme="https" secure="true" keystoreFile="keyStore-1.jks" keystorePass="password" keystoreType="jks" truststoreFile="TrustStore.jks" truststorePass="passwrd" truststoreType="jks" clientAuth="want" sslProtocol="TLSv1.2" /&gt;
  </code></pre>
  
  <p>I am aware of enabling the debug level logging. </p>
  
  <blockquote>
    <p>-Djavax.net.debug=ssl</p>
  </blockquote>
  
  <p>But this logs a lot of information and will slow down the process. And log the success SSL valdiations also. Is there a way to enable the failure cases alone with minimum logs either at Java or Tomcat level. </p>
  
  <p>I am NOT looking this from a debugging perspective, as the SSL debug logs are very good for that. 
  This requirement is more from a logging and auditing purpose and enabling the debug logs is not a feasible option.A mechanism that logs only the errors happening SSL and not all the hex/cert data.</p>