as per request on twitter: how to use client certs