title: Is There Any Reason To Sign Message Bodies When You Are Using Mutual SSL with a Client Certificate
body: <p>I've recently had to implement XML messaging with two large entities that required us to provide an SSL client certificate as well as sign the SOAP message body with a different signing certificate.  Aside from redundancy, does the signing of the message body <strong>WITH A DIFFERENT CERTIFICATE</strong> provide any additional protection?</p>
  
  <p>Edited to provide clarification of the question and point out the years-long misunderstanding between myself and EJP.</p>
  
  <p>The value of signing the message in addition to using SSL with mutual auth (client cert) is that you get non-repudiation.  However, you get that whether or not the client cert is used to sign the message or a different signing cert is used.</p>