> So, here's what's up: applications that rely on client certificates (where the client had to have a valid, accepted cert to make a request) can, on most serve

> So, here's what's up: applications that rely on client certificates (where the client had to have a valid, accepted cert to make a request) can, on most servers, be coerced into accepting unauthorized requests. Am I right in thinking that if you configure your server to always request a client certificate and verify it for every connection to the server, before it hits the web app, then you're fine? Is it only when your server allows anonymous clients and a subset of requests require a client certificate that you have problems?