The JSSE user guide on Sun's site states that a server might send its
cert, or its cert-chain.  It doesn't say when it might do one or the
other, or the repurcussions.

I've got one SSL site (our own) that, via SSL debug mode, I can see
sends its whole cert chain.  Yet, when I hit a third party SSL site,
it only sends its own cert.  Using JSSE with a custom truststore, I
can connect to our site but not to theirs.  The debugging indicates
that since the third-party site only sends its cert, JSSE cannot
verify the third-party's cert up to someone I trust.

However, whenI view that same site in IE and view the cert, it shows a
cert path.  How does IE either (a) infer the cert-chain or (b) query
the server different to get the cert-chain?  JSSE only ever gets the
one third-party cert, while IE somehow gets the chain.

Regards,
Brian.

P.S. I've verified that the "issuer" of the third-party cert is not
itself in the IE cert store: "www.verisign.com/CPS Incorp.by Ref.
LIABILITY LTD.(c)97 VeriSign"