ssl_verify_client_cert=yes does not require a client certificate