When a client performs EAP-TLS authentication, what is required? (Choose two.)