Use a concurrent list because it may be modified while requests are in progress
Only associate the certificate with the request if client cert auth is in use