TLS_CCERT
{ "clientcert", TLS_CCERT},
if (!lflag && (TLSopt & TLS_CCERT))
if ((TLSopt & TLS_CCERT) && !gotcert)