When I try to use the BaseCertLoginModule, it fails with this error:

Don't know how to obtain X509Certificate from: class java.lang.String

I looked at the source code and the failure occurs when the getAliasAndCert() method tries to read a X509 cert from ObjectCallback.getCredential(). Somehow the client cert is not being loaded in the credentials when the callback is done.

Here is my login-config.xml; it is almost exactly as given in the manual:

<login-module code="org.jboss.security.auth.spi.BaseCertLoginModule"
 flag = "required">
 <module-option name="password-stacking">useFirstPass</module-option>
 <module-option name="securityDomain">java:/jaas/encrypt-keystore-password</module-option>
 <module-option name="unauthenticatedIdentity">guest</module-option>
 <module-option name="verifier">org.jboss.security.auth.certs.AnyCertVerifier</module-option>
 </login-module>