TLS configuration needs client certification (why?)