Client cert validation (i.e. mutual authentication) shouldn't be required. `VERIFY_NONE` is only problematic if the client doesn't verify the server