What if we did what's described in your first comment. If the cert and key is provided, accept http and https. If we are verifying the client, then http will just return error message on connection and https will accept if verified. And the --https-address could be used for custom bind?