Just to second this: I have a client seeing this same behavior. They are running a wildcard certificate issued by "DigiCert High Assurance CA-3" whose root is "DigiCert High Assurance EV Root CA" (which is listed as a supported CA by Salesforce).
They have configured a test endpoint in their API manager (Layer 7) which requires 2-way SSL. This endpoint is set up exactly the same as other endpoints they use, which are successfully negotiating 2-way SSL with clients other than Salesforce. We have verified (using OpenSSL) that Layer 7 is presenting their certificate plus the intermediate DigiCert High Assurance CA-3 certificate.
The behavior they are seeing is that they have configured a simple outbound message workflow in Salesforce. When that outbound message is fired, Salesforce connects to their endpoint but fails the 2-way handshake because Salesforce fails to present the Salesforce client certificate.
I have found two other reports around the web from people that claim this exact same issue, also with DigiCert certificates. I have not found similar reports from other CA's. Report 1 Report 2
The only theory we have on this is that Salesforce simply does not correctly support DigiCert certificates. We thought that another theory could be that Salesforce does not support wildcard certs for 2-way SSL, but in digging into this that seems unlikely. I saw a note somewhere that Salesforce only supports wildcards to 1 level deep (i.e. "*.domain.com" would work for "my.domain.com" but not "my.deeper.domain.com"), but the client is only using a 1-level deep domain.
At this point, we have no solution other than to acquire a Verisign certificate and use that for the 2-way SSL, and are not 100% sure that will work. Based on us being at least the fourth person to report that DigiCert certs don't work with Salesforce 2-way SSL I'm pretty confident that this will be the solution.