diff --git a/include/authentication.hpp b/include/authentication.hpp
index 5c7ec19..221e197 100644
--- a/include/authentication.hpp
+++ b/include/authentication.hpp
@@ -185,28 +185,18 @@
 
 inline std::shared_ptr<persistent_data::UserSession>
     performTLSAuth(Response& res,
-                   const boost::beast::http::header<true>& reqHeader,
-                   const std::weak_ptr<persistent_data::UserSession>& session)
+                   const std::shared_ptr<persistent_data::UserSession>& session)
 {
-    if (auto sp = session.lock())
+    if (session != nullptr)
     {
-        // set cookie only if this is req from the browser.
-        if (reqHeader["User-Agent"].empty())
-        {
-            BMCWEB_LOG_DEBUG(" TLS session: {} will be used for this request.",
-                             sp->uniqueId);
-            return sp;
-        }
-        // TODO: change this to not switch to cookie auth
-        bmcweb::setSessionCookies(res, *sp);
         res.addHeader(boost::beast::http::field::set_cookie,
                       "IsAuthenticated=true; Secure");
         BMCWEB_LOG_DEBUG(
             " TLS session: {} with cookie will be used for this request.",
-            sp->uniqueId);
-        return sp;
+            session->uniqueId);
     }
-    return nullptr;
+
+    return session;
 }
 
 // checks if request can be forwarded without authentication
@@ -265,7 +255,7 @@
     {
         if (authMethodsConfig.tls)
         {
-            sessionOut = performTLSAuth(res, reqHeader, session);
+            sessionOut = performTLSAuth(res, session);
         }
     }
     if constexpr (BMCWEB_XTOKEN_AUTH)
diff --git a/include/persistent_data.hpp b/include/persistent_data.hpp
index 3b98e1a..fc69aed 100644
--- a/include/persistent_data.hpp
+++ b/include/persistent_data.hpp
@@ -226,6 +226,7 @@
         authConfig["SessionToken"] = c.sessionToken;
         authConfig["BasicAuth"] = c.basic;
         authConfig["TLS"] = c.tls;
+        authConfig["TLSStrict"] = c.tlsStrict;
         authConfig["TLSCommonNameParseMode"] =
             static_cast<int>(c.mTLSCommonNameParsingMode);
 
diff --git a/include/sessions.hpp b/include/sessions.hpp
index e6e4a68..9f93259 100644
--- a/include/sessions.hpp
+++ b/include/sessions.hpp
@@ -184,12 +184,20 @@
 
 struct AuthConfigMethods
 {
+    // Authentication paths
     bool basic = BMCWEB_BASIC_AUTH;
     bool sessionToken = BMCWEB_SESSION_AUTH;
     bool xtoken = BMCWEB_XTOKEN_AUTH;
     bool cookie = BMCWEB_COOKIE_AUTH;
     bool tls = BMCWEB_MUTUAL_TLS_AUTH;
 
+    // Whether or not unauthenticated TLS should be accepted
+    // true = reject connections if mutual tls is not provided
+    // false = allow connection, and allow user to use other auth method
+    // Always default to false, because root certificates will not
+    // be provisioned at startup
+    bool tlsStrict = false;
+
     MTLSCommonNameParseMode mTLSCommonNameParsingMode =
         getMTLSCommonNameParseMode(
             BMCWEB_MUTUAL_TLS_COMMON_NAME_PARSING_DEFAULT);
@@ -221,6 +229,10 @@
                 {
                     tls = *value;
                 }
+                else if (element.first == "TLSStrict")
+                {
+                    tlsStrict = *value;
+                }
             }
             const uint64_t* intValue =
                 element.second.get_ptr<const uint64_t*>();
diff --git a/include/ssl_key_handler.hpp b/include/ssl_key_handler.hpp
index a8bcfa5..ce1e638 100644
--- a/include/ssl_key_handler.hpp
+++ b/include/ssl_key_handler.hpp
@@ -4,6 +4,7 @@
 
 #include "logging.hpp"
 #include "ossl_random.hpp"
+#include "persistent_data.hpp"
 
 #include <boost/beast/core/file_posix.hpp>
 
@@ -604,11 +605,23 @@
         BMCWEB_LOG_CRITICAL("Couldn't get server context");
         return nullptr;
     }
+    const persistent_data::AuthConfigMethods& c =
+        persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
 
-    // BIG WARNING: This needs to stay disabled, as there will always be
-    // unauthenticated endpoints
-    // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer);
+    boost::asio::ssl::verify_mode mode = boost::asio::ssl::verify_peer;
+    if (c.tlsStrict)
+    {
+        BMCWEB_LOG_DEBUG("Setting verify peer");
+        mode |= boost::asio::ssl::verify_fail_if_no_peer_cert;
+    }
 
+    boost::system::error_code ec;
+    sslCtx.set_verify_mode(mode, ec);
+    if (ec)
+    {
+        BMCWEB_LOG_DEBUG("Failed to set verify mode {}", ec.message());
+        return nullptr;
+    }
     SSL_CTX_set_options(sslCtx.native_handle(), SSL_OP_NO_RENEGOTIATION);
 
     if constexpr (BMCWEB_EXPERIMENTAL_HTTP2)