secure connections to etcd with TLS certs not working

{"level":"info","ts":"2020-07-11T12:01:29.568-0400","caller":"embed/serve.go:191","msg":"serving client traffic securely","address":"127.0.0.1:2379"}
{"level":"warn","ts":"2020-07-11T12:10:17.474-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:59996","server-name":"localhost","error":"tls: client didn't provide a certificate"}
{"level":"warn","ts":"2020-07-11T12:10:33.013-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:59998","server-name":"localhost","error":"tls: client didn't provide a certificate"}
{"level":"warn","ts":"2020-07-11T12:10:53.022-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:60003","server-name":"localhost","error":"tls: client didn't provide a certificate"}
{"level":"warn","ts":"2020-07-11T12:11:13.038-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:60007","server-name":"localhost","error":"tls: client didn't provide a certificate"}
{"level":"warn","ts":"2020-07-11T12:11:38.050-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:60011","server-name":"localhost","error":"tls: client didn't provide a certificate"}
{"level":"warn","ts":"2020-07-11T12:11:41.577-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:60012","server-name":"localhost","error":"EOF"}
{"level":"warn","ts":"2020-07-11T12:13:45.355-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:60038","server-name":"","error":"tls: first record does not look like a TLS handshake"}
{"level":"warn","ts":"2020-07-11T12:14:17.691-0400","caller":"embed/config_logging.go:279","msg":"rejected connection","remote-addr":"127.0.0.1:60041","server-name":"","error":"tls: first record does not look like a TLS handshake"}

Start by tracing the TLS connection setup associated with the embed/serve.go and embed/config_logging.go locations shown in the logs. Reproduce the rejected client-certificate and non-TLS-handshake cases, then determine the expected client behavior from the issue title. Done means secure etcd connections using TLS certificates work without the reported rejection.

Written by the indexing model from the issue text.