If either is set, try to use them.

This should help avoid a situation where someone has half-configured TLS
client authentication and it doesn't work without raising an obvious
error.