The HTTP Request connector is operating as a TLS client when it connects to the target HTTPS API. During the TLS handshake, the server presents its certificate chain. The client must be able to establish a chain of trust from that certificate to a trusted certificate authority.

When no custom Mule truststore is configured, Mule relies on the default Java/JRE truststore. MuleSoft explicitly states that if a tls:trust-store is not specified, Mule uses Java's default truststore, which normally contains certificates for major public certificate authorities.

Therefore, the target API connection succeeds when the issuing CA can be validated through that JRE truststore, assuming the remainder of the TLS negotiation is valid. A keystore serves a different purpose: it normally contains a private key and certificate used to establish the local party's own identity. It is not the default repository used to establish trust in remote HTTPS servers.

The connection also does not automatically trust every CA. Certificate validation still occurs unless validation is explicitly disabled.

Therefore, B correctly describes Mule's behavior when the HTTP Request configuration has no custom TLS truststore configured.

Reference topics: HTTP Request Connector; TLS client validation; Java default truststore; CA certificate chains; keystore versus truststore.

Official documentation: https://docs.mulesoft.com/mule-runtime/4.4/tls-configuration

===============================================================