enforcing mutual auth from the client

[Wall, Stephen]

> A compromised server could easily still request the client certificate, no?

> But as noted, even a compromised server can ask for client credentials and then

Yes, that's true.  If the intruder knew to do so.  Also, a thief can break your window and get into your car, so you might as well leave them rolled down all the time.

The question wasn't "Should I care that..."  or "Is it a good idea to...".  It was "Can OpenSSL 3 do this".