Use the new TLSv1.3 certificate_required alert where appropriate