$ 0 0 I didn't find a way to achieve the goal above. In the end, we decided to use `optional_no_ca` mode and validate certificates on our backend side.