Do any commerical or free servlet containers currently support the retrieval of client and server certificates?
Prasad Thammineni [The Servlet 2.2 spec seems to address this, mentioning that calling ServletRequest.getAttribute(String) with the attribute value javax.servlet.request.X509Certificate will return the client certificate. I presume it will be an instance of a subclass of java.security.cert.X509Certificate. Now what about the server certificate?]
WebSphere Application Server 3.0+ supports retrieval of client certificates. Refer to http://www-4.ibm.com/software/webservers/appserv/doc/v30/ae/web/doc/howto/itaccssl.html.