playframework/Play20 — pull request #340 by bblfish (2012-05-29 10:20:47+00:00)
Title: enable requests to get client Certificates

This patch enables Play2.0's https service to request certificates from the client. Requests can be made on resources that need authentication and only on them.

To try it out you can execute in the console

> run -Dhttps.port=8443 -Dhttps.server.clientTrust=noCA

The "https.server.clientTrust" means that Play2.0 won't refuse certificates just because they were not signed by a well known certificate authority. This is very useful when debugging - as getting client certificates signed by CAs would be extremely tedious. But it is also the way that the WebID protocol works at http://webid.info/spec/ . The public key is still verified: that is that the client has the private key corresponding to the public key sent in the certificate to the Play instance, and this is enough for most use cases.

To test this out create yourself the following controller:

```scala
package controllers

import play.api._
import play.api.mvc._

object Application extends Controller {

def index = Action { req =>
Async {
//timeouts should be set as transport specific options as explained in Netty's ChannelFuture
//if done that way, then timeouts will break the connection anyway.
req.certs.map( cert =>
Ok("Your new application is ready.\r\n\r\n\r\n"+
"cert is"+cert
)
)
}
}

}
```

If you get yourself a certificate at https://my-profile.eu/ with their [Get a WebID](https://my-profile.eu/profile.php ), you can then point the browser you used there to authenticate on https://localhost:8443/ - ie your local server you started above.