**Background**

* I am required to connect to a server for various clients.
* Each client connection should use a unique TLS cert.
* MTLS is in place on the server.
* I want to use connection pooling to improve latency.

Using the following http client

```
<dependency>
   <groupId>org.apache.httpcomponents</groupId>
   <artifactId>httpclient</artifactId>
   <version>4.5.12</version>
</dependency>

```

**My Assumption**
When managing connections in the connection pool, when a connection is being selected the client certificate should be considered before selecting the same connection in the connection pool.
I do not want connections for clientA using clientB TLS cert and vice versa.

**Question**
Is this assumption true?

**Scenario 1)**

I have max connections per route set to 2.
I make a call to the MTLS secured server for client A. (one connection in the pool)
I make a call to the MTLS secured server for client A. (two connections in the pool)
Should this not of reused the first connection?

**Scenario 2)**

I have max connections per route set to 2.
I make a call to the MTLS secured server for client A. (one connection in the pool)
I make a call to the MTLS secured server for client B. (two connections in the pool)

However the second call does not seem to carry out a full handshake an is using clientA certificate.

I would expect the second call to require a full handshake and the connections to be not related in anyway.

Is this the expected behaviour? Am I missing something obvious here?

**Updated simpler test case**

We are now using the http context so I have attached the updated logs.
I have simplified the test case too and now it connects to the same server twice each time it should use a different client certificate.

The application is using spring boot and has a single restTemplate and single httpClient.

Its using a PrivateKeyStrategy to decide what private key/certificate to use when communicating with the server.

The first connection uses key alias 'e2e\_transport\_key\_id\_franek' (you will see this in the logs)

The second connection should use alias 'e2e\_transport\_key\_id\_pdw' (never seen in the logs)

The second connection we are making should use the key/cert with alias 'e2e\_transport\_key\_id\_pdw' however the session is resumed see line 448 Try resuming session. Which means we cannot use the PrivateKeyStrategy to pick the client certificate to use.

How to force the client connection to not reuse the session for connections we intend to use a different client certificate for?

*client logs*
<https://pastebin.com/zN0EW3Qy>