The headache I find with client side certs is that it's annoyingly common for client side apps to have their own CA store which you have to track down and insta

The headache I find with client side certs is that it's annoyingly common for client side apps to have their own CA store which you have to track down and install your CA.crt in.