@marcin: This is the equivalent of HTTPS / just wrapping traffic. There's no client identification going on here. You'll notice

certificate_authorities

is defined but

certificate

and

certificate_key

aren't. The clients are validating they're talking to the right server, but the server isn't validating it's talking to illegitimate clients. Since the cert on the clients is the public cert the server is using in its SSL configuration, if you could find the server, you could use

openssl s_client

and extract the cert it talks to you with, save it, and then set up your own rogue client to talk to his servers, if you really wanted to.