Hi Steve,
first thanks again for your help.
I have another question / problem: I have now a running and working REST API using client certificates auth. Now I would also like to provide an UI which makes using the REST API easier for interactive usage. (so the web UI would internally call the REST API)
a) I got my java web UI as war file. How can I register that war file programmatically with undertow (which also runs my REST API)?
b) Would client certificates also work with web UIs? Would the browser then just ask for the cert or how do I provide in this case the user cert? E.g. when I point right now my browser on an URL of the REST API I just got "Forbidden".
c) If b) is not possible or not easy to do, can I use a different security realm and auth method for the web ui, maybe BASIC AUTH instead CLIENT CERT (but just for the web ui?)