The biggest issue is lack of good documentation. Most examples you command line openssl commands and assumes you do want client authentication. While I do long term, I don't have the tools available at the moment to manage certs that expire for hundreds of edge devices, hence the intermediate objective of getting TLS without authentication. Basically you only need the server CA cert in this case, but neither Node Red or Tulip make this obvious, it just "works" if you already know what you're doing.