After enabling client certificate authentication: Error: {"detail":"Authentication credentials were not provided."}

Summary

[cli]
base_url = "https://pulp3.hostname.tld"
username = "admin"
password = "password"
api_root = "/pulp/"
domain = "default"
format = "json"
cert = "secret/client.cert.pem"
key = "secret/client.key.pem"
verify_ssl = true

First I got CERTIFICATE_VERIFY_FAILED because pulp cli config file has no option for providing CA certificate bundle.
After enabling environment variable export PULP_CA_BUNDLE="secret/ca.crt" a new error appears:

$ pulp --config secret/cli.toml --verbose rpm repository list
repositories_rpm_rpm_list : get https://pulp3.hostname.tld/pulp/api/v3/repositories/rpm/rpm/?offset=0&limit=25
Response: 401
Error: {"detail":"Authentication credentials were not provided."}

Admin credentials didn't change, i just added client certificate authentication requirement to relevant ingress.

Steps to reproduce

As provided above

Expected behavior

pulp cli would return repository list

Pulp and pulp-cli version info

pulp-cli version:
$ pulp --config secret/cli.toml --version
Pulp3 Command Line Interface, Version 0.29.1
Plugin Versions:
common: 0.29.1

Pulp version:
latest default images from pulp-operator

Start by reproducing the verbose pulp --config secret/cli.toml --verbose rpm repository list request with PULP_CA_BUNDLE set, then inspect how pulp-cli combines client certificates, CA bundles, and admin credentials. The secret/cli.toml configuration and PULP_CA_BUNDLE environment variable are the concrete inputs. Done means the authenticated request returns the repository list when client certificate authentication is required.