When configuring LDAP to use certificates, which option should be used with the TLSVerifyClient directive to ask the client for a valid certificate in order to proceed normally?

never explicitly tells the server not to request a client certificate, effectively disabling client certificate authentication.

allow permits the client to present a certificate, but the connection proceeds normally even if no certificate is provided or if verification fails.

try attempts to verify a client certificate if one is presented, but allows the connection to proceed even if no certificate is provided or if verification fails.

In LDAP server configuration (e.g., slapd.conf), the TLSVerifyClient demand directive requires clients to present a valid certificate that can be successfully verified against the server's trusted Certificate Authorities. If the client does not present a certificate or if verification fails, the connection is immediately terminated, ensuring mutual authentication.