The code currently contains the following lines one after the other: -

    engine.setNeedClientAuth (params.getNeedClientAuth());
    engine.setWantClientAuth (params.getWantClientAuth());

However the Javadoc clearly states that calling one will override what was called previously - in other words they should only be called if being set to true.

Note to QE:  I would suggest this issue does not need testing as it was discovered as a side effect to bz1153854 - instead along with bz1153854 we just need to verify no regressions regarding SSL configuration which should actually be picked up by the testsuite already (as this one was).