We should be able to configure https://docs.oracle.com/javase/8/docs/api/javax/net/ssl/SSLParameters.html#getNeedClientAuth-- entirely using ssl-config