When should I use ClientAuthMode Required vs Optional?

Use Required when client certificates must be mandatory. Clients without a valid certificate cannot connect. This is suitable for tightly controlled internal deployments.

Use Optional during migration phases where you still need to accept clients without certificates while validating those that provide one. For strict production access control, prefer Required.