Apigee Edge allows "https" connection to server without certificate

[mark_hammelman]

Hi, My issue is similar to the discussion on this other thread.

I was told that we had a proxy that was connecting to a backend server, and the backend server did not have a certificate, so I started to do some troubleshooting.

I created a targetServer like this:

{
    "host": "revoked.badssl.com",
    "isEnabled": true,
    "name": "badssl-testing",
    "port": 443,
    "sSLInfo": {
        "ciphers": [],
        "clientAuthEnabled": "false",
        "commonName": {
            "value": "*.badssl.com",
            "wildcardMatch": true
        },
        "enabled": "true",
        "ignoreValidationErrors": false,
        "protocols": [],
        "trustStore": "trustStore-outbound"
    }
}

 The proxy has this TargetConnection defined

    <HTTPTargetConnection>
        <LoadBalancer>
            <Server name="badssl-testing"/>
        </LoadBalancer>
        <Path/>
    </HTTPTargetConnection>

My browser tells me that "revoked.badssl.com" does not have a certificate, so there shouldn't be anything in the TrustStore ("trustStore-outbound"), nor should the "commonName" match.

However, I still get a '200 OK' response from the proxy.The trace shows that a successful HTTPS connection was established:

Have I missed something?  As far as I can tell, this should not be working, yet it does.