Client Authentication by Certificate in GAE java

Question

I am writing an application in GAE java which authenticate the user by its certificate. I have created a self signed certificate using keytool at client side. I also enable the https request in google app engine for my application. The flow of application is every simple. User come at home page of application using any browser and then try to access a resource of application. I just authenticate the user is it has valid certificate. I am missing the part that how this certificate that i created at client side will be sent to the application when user access my application by any browser?? Also How i validate the certificate?? Thanks in advance

Answer 1

I did lot of search and come to these point and sharing it here.

1- In this scenario when i browser connect with the server, sending client certificate is the responsibility of browser. The client certificate should have to configured/install/import in the browser. If you are developing client side then you can code to read certificate from you local machine and embed it in the request and then send it to the server.

2- Browser only send certificate to server when server request for it and server had already sent his certificate to browser and this certificate has been validated by the browser. We have to first configured our server to send certificate to client and also request for client certificate. We can validate the client certificate in our application. we just have to extract certificate from the request.

3- Till now GAE don't provide client certificate service. There is no way we can configured our GAE server to request client certificate. May be there would another way to do this but I didn't find any solution for it. I hope in future GAE will support client certificate authentication.