#TIL #pgbouncer has two sets of #certificates related config: one for the service it provides, which, because it's facing clients, are called `client_*`; the ones the service uses, as a #postgres client, to validate upstream servers, are called `server_*`. This, mixed with an internal doc that says "a client certificate that authenticates the [cloud service] to connect to pgbouncer" led me to not understanding anyshit anymore. Worse, for some reason `openssl s_connect` was not finding a cert.

