I think it should be server2.key.insecure. It doesn't make sense to use the certificate authority key as the client key.