client: enable TLS-1.1 for actual client connections