Openssl in client mode: Verify authentication

I want to test my secure server implementation with openssl (v. 1.0.1e). I use openssl in client mode to connect to the server:

openssl s_client -cert client.pem -connect localhost:8888 -debug

This succeeds and I see that a SSL handshake has taken place.

The server is configured to reject any client that does not present a certificate. I use the above command without the -cert switch but the connection to the server is successfully established.

The documentation specifies:

-cert certname
The certificate to use, if one is requested by the server. The default is not to use a certificate.

In the wireshark (v. 1.8.10) trace I see that both scenarios (ie. with and without the -cert switch) contain the same steps. The protocol is TLSv1:

1. Client Hello
2. Server Hello, Certificate, Server Key Exchange, Server Hello Done
3. Client Key Exchange
4. Change Cipher Spec
5. Encrypted Handshake Message
6. Change Cipher Spec
7. Encrypted Handshake Message

Why does the connection succeeds in both scenarios although the server should reject clients without certificates? Does step 3 indicate that the client's certifcate is presented to the server? How do I get openssl to not send a certificate at all?

Recent Questions...