PKI client authentication working with browsers and wget (but not curl - reason unknown)