But @jonofe 's issue might be completely different. I am wondering if it's actually CA related, since normally the client will tell the server that the CA isn't trusted, and I'm not seeing that at all ...