What if the server is using certificate-based authentification ? Does the 'hacker' has to prsent a valid certificate to use shellshock or are there any server-s

What if the server is using certificate-based authentification ? Does the 'hacker' has to prsent a valid certificate to use shellshock or are there any server-side shell script that might be called during the authentication process ? I'm using endian firewall (v2.5 community, based on ipcop). I have installed up-to-date bash version, but, you know, you're never sure !