Recently I was debugging a mutual TLS issue between a MQTT client and a broker. For the TLS setup, a self-signed CA was used to sign both server certificates and client certificates.
Both server and client trust stores had the CA certificate present.
During the handshake I observed, both brokers (RabbitMQ and Mosquitto) sent the CA certificate along with the server certificate.
But on clients, except for JAVA(PAHO), the Python and the nodejs clients both were also sending the CA certificate they had with their response to the server.
If the CA certificates were already installed in the trust stores of both the server and client, why should they exchange the CA at all during the handshake?
PS: Also JAVA client was never sending the CA certificate in its response. In which case, if the server did not send the certificate the handshake failed, but for other clients even if the server did not send the CA in the handshake, the clients were sending the CA in their response and the handshakes were successful.