I am observing an issue in which the TLS handshake is failing between a Java Client and a web service hosted under IIS 7. Upon wiresharking the attempt it seems that the problem is the list of trusted authorities provided in the Certificate Request Frame does not include the Intermediate CA which signed the client cert that is intended to be used. In looking at the RFC it states that the frame should include
A list of the distinguished names of acceptable certificate authorities. These distinguished names may specify a desired distinguished name for a root CA or for a subordinate CA; thus, this message can be used both to describe known roots and a desired authorization space.
To me this means that the intermediate should have been included. Is there some hidden setting to force the Intermediate CA to be include or am I incorrect in my interpretation of the spec. If I am incorrect I do not see how the proper client cert could ever be identified.
Edit: To give a little more background. The trust chain in question in from Entrust and is three levels deep, the CA, an Intermediate CA and the leaf. In this case the service is secured by a Server Cert signed by the intermediate and the client is calling using a Client Cert signed by the same intermediate.