I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container.
From the user point of view in the browser, everything seems to work fine with a cert challenge. This is on an intranet with a proxy.
My goal is have the user x509 cert dn written out to the AccessLogValve logs.
Following this post I have modified the AccessLogValve pattern (in server.xml) to include:
%{javax.servlet.request.X509Certificate}r
However what is written to the logs are strings like this:
[Ljava.security.cert.X509Certicate;@4737f9e8
My concern is that the cert-related headers are being dropped, so I have also enabled the RequestDumperFilter in web.xml to look for clues in the headers. In those logs I don't see anything cert-related other than possibly:
remoteUser=null
isSecure=true
=============
authType=null