allow client certificate to be provided