Mutual authentication not established for outbound connection

Client certificate is missing, expired, or not properly configured in the certificate store for the outbound connection. (high likelihood)

The server presented an untrusted certificate that is not in ServiceNow's trusted certificate store or certificate chain is incomplete. (high likelihood)

Certificate Subject Alternative Names (SAN) or Common Name (CN) do not match the target server hostname in the outbound request. (medium likelihood)

Network proxy or firewall is intercepting SSL handshake and breaking the mutual authentication process. (medium likelihood)

SSL/TLS protocol version mismatch between ServiceNow instance and target server during certificate negotiation. (low likelihood)

Step 1: Navigate to System Web Services > Certificates and verify that the required client certificate exists and has not expired.

Step 2: Check the certificate format and ensure it includes both the certificate and private key, typically in PEM or PKCS#12 format.

Step 3: Go to System Web Services > Trusted Server Certificates and confirm the server's certificate or its CA is present in the trusted store.

Step 4: Review the outbound REST message or web service configuration to ensure the correct certificate is selected in the authentication settings.

Step 5: Test the connection using System Web Services > Test Connection or create a test script to validate the certificate handshake.

Step 6: If using a proxy, check System Properties for com.glide.communications.httpclient.proxy settings and ensure proxy supports SSL passthrough.

Step 7: Enable SSL debugging by setting com.glide.communications.httpclient.ssl_debug to true in System Properties and review detailed handshake logs.

Step 8: Contact the target server administrator to verify their certificate configuration and ensure mutual TLS is properly enabled on their endpoint.