fixed default SNICallback
use self-signed CA for client cert