Can I have Mutual/2 Way SSL without having https connection? - spring-boot

Question

I am very new to this SSL configurations. I am working on adding 2 way ssl configuration on a Springboot application. I have gone through lot of code snippets online on this implementation.
My destination server end point - https://endpoint.com/path/to/service is secured to which I make a REST call.
If I set my application.yml:
server:
port: 9001
ssl:
enabled: true
client-auth: need
key-store: classpath:KEYSTORE.pfx
key-store-password: password
key-alias: aliasname
key-store-type: PKCS12
trust-store: classpath:TRUSTSTORE.p12
trust-store-password: password
trust-store-type: PKCS12
My application runs on https://localhost:9001.
TRUSTSTORE.p12 contains the server's public certificates and CA certificates.
With this setup, I'm able to get response from the server using RestTemplate configurations.
When I give another TrustStore which doesn't have my Server's public Certificate, it fails to establish a connection - Expected behaviour.
But when I disable the SSL:
server:
port: 9001
ssl:
enabled: false
My application runs on HTTP//:localhost:9001.
Will I still be able to make a Mutual authentication with the truststore and keystore available at my SSL Context?
Can I Still validate the server's public certificate with the above yml configuration and the below code?
// KeyStore and TrustStore
keyStore = KeyStore.getInstance("pkcs12");
ClassPathResource classPathResource = new ClassPathResource("KEYSTORE.pfx");
InputStream inputStream = classPathResource.getInputStream();
keyStore.load(inputStream, "password".toCharArray());
TS = KeyStore.getInstance("pkcs12");
ClassPathResource classPathResource1 = new ClassPathResource("TRUSTSTORE.p12");
InputStream inputStream1 = classPathResource1.getInputStream();
TS.load(inputStream1, "password".toCharArray());
// configuring the SSLContext
SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(
new SSLContextBuilder().loadTrustMaterial(TS, new TrustSelfSignedStrategy())
.loadKeyMaterial(keyStore, "password".toCharArray()).build());
NOTE: With ssl set to FALSE other applications would call my endpoint at http//:localhost:9001. And I would make a REST call the server on https://endpoint.com/path/to/service.

Answer 1

You cannot have mutual SSL authentication without having SSL. While one might probably construct some kind of mutual authentication method which works with plain HTTP instead of HTTPS there is no standard for this. The usual certificate based mutual authentication which is implemented in the browsers works only with HTTPS since it is actually part of the SSL layer.