Question: Mutual SSL Authentication is working fine while client is sending **certificate of zero size.**
And **certificate verify message** is also **missing**.
I am amazed how the communication is working fine.
I have TCP dump but I can't share due to security policy of our company.

How is it possible that the communication is working although the client is sending a certificate with zero size?

[![enter image description here](https://i.stack.imgur.com/HCc8J.jpg)](https://i.stack.imgur.com/HCc8J.jpg)

Answer: 
A certificate with 0 bytes is sent by the client if the server requests a certificate but the client has no certificate. How the server deals with the empty certificate depends on the configuration:

With apache you can set the [option SSLVerifyClient](http://www.modssl.org/docs/2.1/ssl_reference.html#ToC13) to `optional` to require a certificate but accept an empty one too. If you instead set it to `require` it should fail if only an empty certificate gets provided. Other servers have similar options.
Optional client certs?

Sounds like your server is enforcing OPTIONAL (and not mandatory) client certs. 

<http://www.modssl.org/docs/2.1/ssl_reference.html#ToC13>