Client certificate as part of SSL

Question

I am using the javax.xml.soap.SOAPConnection in my application hitting an HTTPS site to get SOAP data. From what I can see, this is using the default JSSE behavior for the entire SSL session. The server is requesting a client certificate during the SSL handshake. This is where my problem is coming up.
Since I have done nothing to set up the SSL connection explicitly, I am unclear on where the application will pick the certificate up from? I added my client SSL certificate to a custom .keystore in my runtime directory as well as in the $JAVA_HOME/jre/lib/security/cacerts, but when I run the application with the "-Djavax.net.debug=all" (debug on), I do not see the client cert being sent.
So, my questions were:
(a) which keystore should my cert be added to?
(b) how do I specify to the JSSE which cert in the keystore defines my client SSL cert? i.e. which cert should the JSSE send back to the server when a request for cert is received from the server. I found no "setClientCert" like API, but then I am not really talking at the socket level either from the SoapConnection class.
(c) is there a default "alias" name that I need to use when I import my cert such that the JSSE will pick it?
Attached are snippets from my debug log.
*** ClientHello, v3.1
<<< Some cipher information here >>>
*** ServerHello, v3.1
<<< Some cipher information here >>>
*** Certificate chain
<< Servers certificate here >>>
*** CertificateRequest
<< server is requesting the client certificate here>>
*** ServerHelloDone
*** Certificate chain
<< SHOULD HAVE HAD THE CLIENT CERT, but instead is blank>>
KeyExchange, etc. continues but when I send the data, I get a 403 forbidden.
Any help would be appreciated. Thanks.
Madhuri

Answer 1

Thanks for your help.
I have resolved my problem. It turned out that in order to get Sun's JSSE to read my keystore, I needed to set the "javax.net.ssl.keyStore" system property. I chose to let the default trust manager "cacert" be used and that worked fine. The other problem that I had to fix was to have my key contain the full cert chain to the CA, before it got sent.
I found the following article on the ibm developerworks finally resolve most of my questions.
http://www-106.ibm.com/developerworks/java/library/j-customssl/
I still have an open issue that will post seperately dealing with the key that JSSE picks from the keystore. It just takes the first key that matches the cert request and doesn't seem related to any naming and the only way to explicitly specify the key to use is by writing a custom KeyStore and have that be used in the SSL socket creation. However, when I am using the SOAP classes, I am a few levels of abstraction away from the actual Socket creation and this prevents me from setting the client cert explicitly. Any ideas?