webMethods Knowlegebase : Two-Way SSL Handshake issue when Integration Server acts as an SSL Client. (1751226)

Problem

Two-Way SSL Handshake issue when Integration Server acts as an SSL Client.

Here is the issue:

In a Two-Way SSL connection, both Integration Server and the partner application require access to each other's SSL certificates in order to authenticate each other, establish an SSL connection, and transmit information.

Note: 1. IS ( Client ) ----HTTPS w/Cert Auth----> 3rd party ( Server).

2. Certificates were installed on IS and 3rd party servers respectively.

Test Case #1: 3rd party deleted client (IS) Public Certificates, Inter and Root.. SSL Connection failed . Test case ok.

Test Case #2: Client (IS) deleted 3rd party's Public, Inter and Root Certificate. As per the 2 way SSL Handshake. It should not work but It worked.

Test Case #3: 3rd party deleted their (Server) "Inter" and "Root" Certificate and not presented any CA's certificate to Client. It should not work but it worked.

Test Case #4: 3rd party deleted Client (IS) inter and Root from their ( Server) trusted directory then It failed - Test case OK.

When Server does not send CA's Certificates to Client (IS) then i can see in the SSL log "empty list" but still authentication working.

I just want to know where is the issue for Test case #2 and #3 during the 2 way ssl handshake when IS act as a Client and how IS validate chains of certificates of ( Root>Inter>Public) during the ssl when IS Act as an client.