IMO the best workaround would be to have clients ask if it should use a client certificate when it reaches the URL from a cross-origin link or redirect -- Sent from my Android device with K-9 Mail. Please excuse my brevity.