Salesforce can use a SSL certificate to authenticate itself with a third party server, but can a third party server authenticate with a Salesforce in the same manner? Our use case is that we have legacy apps that use non-authenticated REST calls, with a mediator that redirects those devices to the correct endpoint, such that the legacy apps do not need to ever have their configuration updated directly. We would like to be able to authenticate as a user and access custom REST web service methods without having to supply a username, password, or token, but still have the client authenticated by way of a SSL certificate, simply by installing the appropriate certificate.
If I understand you correctly, you want to make web service callouts from Salesforce org to your legacy apps behind the mediator. You will only need Two-Way SSL when making web service callouts from Salesforce org to external systems. See Making Authenticated Web Service Callouts Using Two Way SSL. You can install Apache HTTP server on your mediator and use it as a revers proxy to delegate requests to appropriate legacy apps. The Apache HTTP server deals with SSL configuration. You will need to install your external system's domain certificate on Apache server. Also you need to generate the certificate for Salesforce on the Apache server and upload the certificate back to the Salesforce org.