if (securityRealm.hasTrustStore()) {
// For this to return true we know we have a trust store to use to verify client certificates.
if (auth == null) {
certAuthMode = CertAuth.NEED;
auth = new ClientCertAuthenticator(new AuthenticationProvider(securityRealm), securityRealm.getName());
} else {
// We have the possibility to use Client Cert but also Username/Password authentication so don't
// need to force clients into presenting a Cert.
certAuthMode = CertAuth.WANT;
}