add note about needing to generate CRLs before connecting with client certificate