but there is a debug
println in SSLSocketImpl at line 917. Running a simple test case
produces output like the following:

   # java -Djavax.net.ssl.keyStore=ks -Djavax.net.ssl.trustStore=ks JSSESimple
   need_client_cert is 0
   need_client_cert is 0

Here's the simple test case I ran against Merlin build 41, for what it's
worth:

   import java.io.*;
   import java.net.ServerSocket;
   import java.net.Socket;
   import javax.net.ssl.*;

   public class JSSESimple {
       static final String HELP =
"java [properties] JSSESimple\n" +
" Properties:\n" +
" -Djavax.net.ssl.keyStore\n" +
" -Djavax.net.ssl.keyStorePassword\n" +
" -Djavax.net.ssl.trustStore";

       public static void main(String[] args) throws Exception {
if (args.length > 0 && args[0].startsWith("-h")) {
System.err.println(HELP);
System.exit(0);
}

final ServerSocket serverSocket =
SSLServerSocketFactory.getDefault().createServerSocket(0);
new Thread() {
public void run() {
try {
Socket socket = serverSocket.accept();
socket.getInputStream().read();
OutputStream out = socket.getOutputStream();
out.write(0);
out.flush();
} catch (IOException e) {
System.out.println("Exception: " + e);
}
}
}.start();

Socket socket = SSLSocketFactory.getDefault().createSocket(
"localhost", serverSocket.getLocalPort());
OutputStream out = socket.getOutputStream();
out.write(0);
out.flush();
socket.getInputStream().read();
       }
   }