<p>I'm running an application (web service) in tomcat with TLS enabled (with certificates both for the client and the server).</p>

<p>I want that my application will be able to send audit message (logging) when TLS handshake fails. For example I want to log when:</p>

<ul>
<li>the client certificate is expired,</li>
<li>the client certificate is unknown (not in the server trust store)</li>
<li>any other  handshake failure</li>
</ul>

<p>Is there any event that I can catch and handle in order to do that?</p>

<p>My application is web service based and is running in tomcat. Tomcat is handling all network and the TLS layers, and the application does not aware of that.</p>

<p>As I don't open any socket myself, where should I catch this Exception?</p>

Since I spent the past week debugging Tomcat's SSL configuration, I am pretty sure catching
```
javax.net.ssl.SSLHandshakeException
```
in your code and logging it should take care of all three of those errors.
When you instantiate a new webservice connection in your application, that is when the exception will occur.