using server cert as CA info + self-signed client cert