gah I can't believe I forgot about this - I meant to mention it right in the PR description. With `CERT_REQUIRED`, cert validation fails in the tests, since it doesn't recognize the CA, despite passing the path to `certs.pem` as the `ca_certs` parameter. Is the test server certificate self-signed?