Does Prometheus monitoring need to do client certificate validation?

We’re scraping the `/metrics` of TiDB components (tikv, pd, tidb) outside of the TiDB monitor stack and found that we need to export the TLS items created by the operator to allow Prometheus to successfully scrape these components (otherwise the server rejects the request).

My understanding is that metrics run on a different port which should be safe to lower the security requirements. Is there a reason SSL verification is needed for Prometheus monitoring too?