diff --git a/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java b/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java
index ab3d46ac..9bfcbe26 100644
--- a/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java
+++ b/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java
@@ -153,10 +153,14 @@ public static SSLContext createContext(String context, ConfigurationProperties c
     return sslContext;
   }
 
-  public static SSLEngine createSSLEngine(SSLContext sslContext, ConfigurationProperties tls){
+  public static SSLEngine createSSLEngine(SSLContext sslContext, ConfigurationProperties tls) {
     SSLEngine sslEngine = sslContext.createSSLEngine();
-    sslEngine.setNeedClientAuth(tls.getBooleanProperty("clientCertificateRequired", false));
-    sslEngine.setWantClientAuth(tls.getBooleanProperty("clientCertificateWanted", false));
+    boolean clientCertificateRequired = tls.getBooleanProperty("clientCertificateRequired", false);
+    if (clientCertificateRequired) {
+      sslEngine.setNeedClientAuth(true);
+    } else {
+      sslEngine.setWantClientAuth(tls.getBooleanProperty("clientCertificateWanted", false));
+    }
     return sslEngine;
   }
 
diff --git a/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java b/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java
index 29d29187..90a81004 100644
--- a/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java
+++ b/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java
@@ -54,4 +54,25 @@ void simpleHelperTest() throws Exception {
     SSLEngine sslEngine = SslHelper.createSSLEngine(sslContext, new ConfigurationProperties() );
     Assertions.assertNotNull(sslEngine);
   }
+
+  @Test
+  void clientCertificateAuthenticationModesAreMutuallyExclusive() throws Exception {
+    SSLContext sslContext = SSLContext.getDefault();
+
+    assertClientAuthenticationMode(sslContext, false, false, false, false);
+    assertClientAuthenticationMode(sslContext, false, true, false, true);
+    assertClientAuthenticationMode(sslContext, true, false, true, false);
+    assertClientAuthenticationMode(sslContext, true, true, true, false);
+  }
+
+  private void assertClientAuthenticationMode(SSLContext sslContext, boolean required, boolean wanted, boolean expectedRequired, boolean expectedWanted) {
+    ConfigurationProperties properties = new ConfigurationProperties();
+    properties.put("clientCertificateRequired", required);
+    properties.put("clientCertificateWanted", wanted);
+
+    SSLEngine sslEngine = SslHelper.createSSLEngine(sslContext, properties);
+
+    Assertions.assertEquals(expectedRequired, sslEngine.getNeedClientAuth());
+    Assertions.assertEquals(expectedWanted, sslEngine.getWantClientAuth());
+  }
 }