Using client cert authentication only requires the use of a "user" and "password" in the bcfg2.conf file.

[https://www.google.com/accounts/o8/id?id=AItOawnPNO575Ac539IZRvLidywOmgljMJLKo7U]

When using client certs as an authentication method *strictly*, the SSL code still requires that the client set a username and password (as a part of the URL that the code uses to connect to the server). This is because the server is expecting an Authorization header. Even though these values are ignored it is required for a proper session.

This requirement is confusing and undocumented and should probably be removed and/or documented.

I suppose a default username and password can also be used if a client cert is defined and no username and password exist.

[solj]

Duplicate (somewhat) of #905.