certs will be NULL for outgoing proxy sockets.