do not require private key when getting client certificate