In Java, the SSLSocket#setNeedClientAuth and SSLSocket#setWantClientAuth methods can be used by the server to require or request client authentication. If the server doesn’t set either to true, according to the Javadocs of the methods, the behavior should be “no client authentication desired”.

In that case, if the client insists on presenting a client certificate, what happens? Should the server

1. fail the TLS handshake, or
2. ignore the client certificate and proceed with the handshake, or
3. attempt to perform client authentication since it’s unsolicitedly provided by the client?

Or is the behavior unspecified? I couldn’t find any explicit mention of this in https://www.rfc-editor.org/rfc/rfc5246#section-7.4.6.