title: Putting X509 Certificate in HTTP Request
body: <p>I'm using Spring Security for <code>X.509 preauthentication</code>.</p>
  
  <p>To make sure the client sends its certificate per HTTP request, is it necessary to:</p>
  
  <ul>
  <li>Modify pom.xml to set <code>&lt;wantClientAuth&gt;</code> and <code>&lt;needClientAuth&gt;</code> to <code>true</code></li>
  <li>Set Apache's <code>SSLVerifyClient</code> to <code>require</code> <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslverifyclient" rel="nofollow">reference</a></li>
  </ul>
  
  <p>Based on reading, the web server must tell the client-side to sends its certificate in order for the client to actually send it. I'm confused if Spring Security AND Apache configuration is required to achieve this.</p>