In Apache HTTPD it is possible to create custom request logs which include the value of SSL_CLIENT_S_DN. Since the site requires mutual authentication (client certificates) this provides a good audit log of who is accessing the web server. The question is we have a large number of tomcat hosts as well and would like to do the same thing with request logs created by tomcat. I can't seem to find a way to do it though. I have looked at access valves in tomcat but can't seem to find an appropriate variable.
I've been looking here for configuration information: http://tomcat.apache.org/tomcat-7.0-doc/config/valve.html#Access_Log_Valve
Also these are tomcat instances with the HTTPS connector configured with clientAuth=True. They are not sitting behind a proxy.
How can I log the client certificate DN in a request log?