SSL client cert should be optional