Sometimes the initial handshake between a ssl client and a ssl server involves the client presenting to the server a ssl certificate in order to prove, that no "man in the middle" attack is taking place. The certificates of all clients allowed to communicate with the server are registered with it. In such a configuration you have to provide JSSLtrace with a valid client certificate and, unfortunately, the private key, which belongs to the certificate, otherwise JSSLTrace won't be able to communicate with the remote server. See samplehttps.xml in the examples folder for further details (key use-client-authentication and the section client-authentication just below).