@sethterashima care to comment from a security perspective?

@bramp @patrickdemers6 no objection on my end, but I'd ask that: (1) the setting should be off by default and (2) if the setting is on and the server does receive a matching TLS client certificate, the connection should be (noisily) rejected with a call to action to disable the setting in the server configuration. The second requirement will prevent a user from inadvertently copy+pasting a configuration that makes them silently insecure. (Of course the second requirement is moot if it only accepts non-TLS connections).

I think those are both fair requirements.

To clarify #2, 'matching TLS client certificate', matching meanings a valid Tesla client cert? Should we instead just reject all client certs?

If the connection is over a trusted network and the telemetry server is only listening for HTTP (not HTTPS), then client certs are a moot point.

If the telemetry server is still using HTTPS (I'll defer to you and @patrickdemers6 on how likely this would be in contexts where there's a proxy), then rejecting all connections that use a client certificate is fine by me; if someone comes along who wants the proxy to authenticate with with the telemetry server using mTLS, then they're welcome to put in a feature request or PR.