s := xhttp.ConnSettings{
		LookupHost:       globalDNSCache.LookupHost,
		DialTimeout:      defaultDialTimeout,
		RootCAs:          globalRootCAs,
		CipherSuites:     fips.TLSCiphersBackwardCompatible(),
		CurvePreferences: fips.TLSCurveIDs(),
		TCPOptions:       globalTCPOptions,
		EnableHTTP2:      false,
	}

	if clientCert != "" && clientKey != "" {