always throw in tls_reqcert as it has a sane default