...
If you are using a Java bean as your adapter, ensure you have defined the bean and set the alias configuration to use that bean instead. Also double check the class is correct and is being injected via Spring.
If a webservice web service is being used, ensure the web proxies are set and the URL of your webservice web service is listed in the Internal Exchange Info configuration under the correct service name and API spec level.
...
CONNECT uses the Direct JAVA RI for retrieving certs certificates via DNS. The logic used there is that it checks for an individual cert certificate first, in your case it would be admin.mail.testserver.com, and if this CERT record isn’t found then it will look for the organization cert certificate at mail.testserver.com.
The PKIX path errors are because one machine doesn't trust the other?
...