I had explicitly set the cert values in the global

client.conf

as a test. One sec I'll swap it back