well… at least according to the source, it depends on the TLS profile that’s used: https://github.com/kolide/fleet/blob/master/cmd/fleet/serve.go#L317

Yes, nice find in the source. It's also going to depend on what the client claims to support.