Hello,
I set Required certificate authentication mode on WebSeal Appliance 9.0.7.
Documentation said that "WebSEAL always requires a client-side certificate with the first HTTPS request".
But when client-side application (Mobile app) send second request without certificate (first request was successful SSL handshake) - it fails with error, that certificate wasn`t sent. 
Is it work right and there MUST be certificate in each request? How can I debug this request (SSL) on  Appliance 9.0.7?

Thanks!

------------------------------
Kirill N
------------------------------

Hi Kirill,

When client certificate is "required" or "optional", Reverse Proxy will request a client certificate during the negotiation of each new TLS/SSL connection.  This is part of the "Client Hello/Server Hello" exchange that starts a TLS/SSL connection.  A certificate is not required again until a new TLS/SSL connection is started.

If you're seeing the requirement for a certificate on every request, it is likely that the client is starting a new TLS/SSL connection for each request instead of reusing the existing TLS/SSL connection.  In addition to causing this issue related to certificates, starting a new TLS/SSL is expensive and so you should ask the mobile app developer to rework their code.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------