When configuring LDAP to use certificates, which option should be used with the TLSVerifyClient directive to ask the client for a valid certificate in order to proceed normally?

The `never` option instructs the server not to request or verify any client certificates, effectively disabling client-side certificate authentication.

The `allow` option is not a standard or commonly recognized setting for the `TLSVerifyClient` directive in OpenLDAP configurations.

The `try` (or `optional`) option allows the server to request a client certificate but will proceed with the connection even if the client doesn't provide one or if it's invalid, offering weaker authentication than `demand`.

For LDAP server configurations using TLS, setting the `TLSVerifyClient` directive to `demand` enforces mandatory client certificate authentication. This means the server will explicitly request a client certificate during the TLS handshake, and if the client does not provide a valid, trusted certificate, the connection will be terminated.