I thought that the native-tls flag would enable the native-ssl client but after close inspection, which is openssl in Linux, but, counter-intuitively, it actually just enables loading native certs using rustls and by extension ring, which has limitations e.g.: briansmith/ring#1631.