When the client has its own trust manager and the server does setNeedClientAuth(true), the client does not return a certificate to the server and bad_certificate is thrown.

Exception in thread "main" javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1586)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:865)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.waitForClose(SSLSocketImpl.java:1368)
        at com.sun.net.ssl.internal.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:103)
        at com.sun.net.ssl.internal.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:606)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:808)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:734)
        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:197)
        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:511)
        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:449)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:817)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1029)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:621)
        at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
        at java.io.OutputStream.write(OutputStream.java:58)
        at sslbug.Client.main(Client.java:26)


The behaviour is the same in JDK 1.5 and 1.6. In IBM's J9 1.5 the repro works as expected.

Se attahced reproduction.
in JSSE, a trust manager used to authenticate server endpoint, it is not used for client certificate choose. In the bug description, the client does not send a proper certificate to server, which may be caused by:
1. the server failed to authenticate the client server, or
2. the client key manager failed to choose a proper certificate, which result in 1.

Did the user custome the key manager? Is it sure that the server side has a proper trust key store which will trust the client cert? We need more information, it would be great help if the debug message given.