Currently we have two levels for client authentication, one user level keystore and the other is system level keystore. When user is running an applet from a client authentication enabled https server, Java plugin and Java webstart will only retrieve certificates from user level keystore (plus browser keystore if option is enabled), but not from system level client authentication keystore.