which let's encrypt cert needs to be on the client-side to ensure a proper enrollment? I've tried them all.