Resolution:
At server end, configure tibemsdssl.conf (and use this .conf file when starting the EMS server) as:

ssl_server_identity     = certs/server.cert.pem
ssl_server_key          = certs/server.key.pem
ssl_password            = password

ssl_server_trusted      = certs/client_root.cert.pem
ssl_require_client_cert = enabled

On the BW end:

1). Create a folder (certs), import the server's root certificate (certs/server_root.cert.pem) into this folder.

2). Create an identity:
       Type = Identity File
       URL = file://D:/TIBCO/ems/bin/certs/client_identity.p12
       File Type = PKCS12
       Password = 'password'

3). Create a JMS connection and configure SSL:
       Trusted certificates folder = certs
       Identity = identity.id (you created just now)

4). Do a "Test Connection".