Tomcat SSL requirement from client

    <Connector port="443"
               keystoreFile="/root/certificates/keystore.store"
               keystorePass="<keystorePass>"
               SSLEnabled="true"
               maxThreads="150"
               scheme="https"
               secure="true"
               connectionTimeout="2000"
               clientAuth="true"
               sslProtocol="TLS"
               address="172.16.95.162"
               restrictedUserAgents="^.*MS Web Services Client Protocol.*$"/>

clientAuth - Set to true if you want the SSL stack to require a valid certificate chain from the client before accepting a connection. Set to want if you want the SSL stack to request a client Certificate, but not fail if one isn't presented. A false value (which is the default) will not require a certificate chain unless the client requests a resource protected by a security constraint that uses CLIENT-CERT authentication.