That's true for DER files, but not for all certificate formats (PEM and PKCS#12 can have both key and certificate rolled into one file). But if that was the problem, then IO::Socket::SSL would complain loudly and the handshake wouldn't complete. So I rather guess that the server didn't request a client certificate.