Summary

In this chapter, we examined the architecture, flow, and Spring Security support for client certificate-based authentication. We have covered the concepts and overall flow of client certificate (mutual) authentication. We explored the important steps required to configure Apache Tomcat for a self-signed SSL and client certificate scenario.

We also learned about configuring Spring Security to understand certificate-based credentials presented by clients. We covered the architecture of Spring Security classes related to certificate authentication. We also know how to configure a Spring bean-style client certificate environment. We also covered the pros and cons of this type of authentication.

It's quite common for developers unfamiliar with client certificates to be confused by many of the complexities of this type of environment. We hope that this chapter has made...