Tomcat Client authentication

Question

I want to make sure that my webapp is secured:

I have a tomcat server - and defined the connector to use clientAuth="true". In my trust store there is only the certificate of my CA (self signed).

On the client - installed a certificate issued by the CA.

As I was warned in a previous question I made , I want to make sure that:

1. The tomcat server - gets the client's certificate - makes sure it is signed by the CA, and then - authenticates the client by using the public key in the client's certificate - to make sure that the client can really decrypt the data.

and not:

2. The tomcat server - gets the client's certificate - makes sure it is signed by the CA and then start communication without verifying that the sender of the certificate is really the owner of the private keys associated with it

So - is option 1 or 2 is true?

Thanks

Answer 1

As part of the handshake for mutual auth SSL, both the server and the client have to prove that they hold the private key corresponding to their cert. If that isn't the case, the SSL handshake will fail. I think that is option (1) of your question.