--- a/java/org/apache/tomcat/util/net/jsse/JSSEKeyManager.java	
+++ a/java/org/apache/tomcat/util/net/jsse/JSSEKeyManager.java	
@@ -120,4 +120,7 @@ public final class JSSEKeyManager extends X509ExtendedKeyManager {
             SSLEngine engine) {
         return delegate.chooseClientAlias(keyType, issuers, null);
     }
+    public  X509KeyManager getDelegate() {
+        return delegate;
+    }
 }
--- a/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java	
+++ a/java/org/apache/tomcat/util/net/jsse/JSSESSLContext.java	
@@ -51,6 +51,13 @@ class JSSESSLContext implements SSLContext {
             throws KeyManagementException {
         this.kms = kms;
         this.tms = tms;
+        if (kms != null) {
+            KeyManager[] kmds = new KeyManager[kms.length];
+            for (int i = 0; i < kms.length; i++) {
+                kmds[i] = ((JSSEKeyManager) kms[i]).getDelegate();
+            }
+            context.init(kmds, tms, sr);
+        } else
         context.init(kms, tms, sr);
     }