update tls config

* ensureCertificates now adds local IPs to subjectAltName. This allows clients to validate the server when connecting via IP
* fixed tls config passed to the client