I want to make sure that my webapp is secured:
I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed).
On the client - installed a certificate issued by the CA.
As I was warned in a previous question I made , I want to make sure that:
- The tomcat server - gets the client's certificate - makes sure it is signed by the CA, and then - authenticates the client by using the public key in the client's certificate - to make sure that the client can really decrypt the data.
- The tomcat server - gets the client's certificate - makes sure it is signed by the CA and then start communication without verifying that the sender of the certificate is really the owner of the private keys associated with it
So - is option 1 or 2 is true?