Force envoy proxy to send client certificate or log the reason why it's not sent

I try to convince an envoy proxy to communicate with another envoy proxy. The connection shall be secured via mTLS (mutual TLS, aka required client certificates).

The problem is, that the "api" envoy proxy is requesting a client certificate and the "app" envoy proxy does not send one. Hence, the connection is terminated.

When the "envoy api" is configured to not require a client certificate, the whole connection does work. However, if I require the client certificate, the app envoy does not send one and the connection will fail.

The configurations and a demo application (docker-compose) are all open sourced: https://github.com/WirePact/docker-demo/tree/feat/demo-app

In the "hack" directory, the configurations are stored.

Then envoy API listener has transport socked configured:

transport_socket:
  name: envoy.transport_sockets.tls
  typed_config:
    '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.DownstreamTlsContext
    require_client_certificate: true
    common_tls_context:
      validation_context:
        trusted_ca:
          filename: /certs/chain.crt
      tls_certificates:
        - certificate_chain:
            filename: /certs/cert_with_ca.crt
          private_key:
            filename: /certs/cert.key

And envoy app has the forwarding proxy with transport socket configured:

clusters:
  - name: dynamic_forward_proxy_cluster
    lb_policy: CLUSTER_PROVIDED
    transport_socket:
      name: envoy.transport_sockets.tls
      typed_config:
        '@type': type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
        common_tls_context:
          validation_context:
            trusted_ca:
              filename: /certs/chain.crt
          tls_certificates:
            - certificate_chain:
                filename: /certs/cert_with_ca.crt
              private_key:
                filename: /certs/cert.key

Both envoys get their certificates from the same directory, but with different "cert_with_ca". They have their own certificates, but signed from the same CA.

Sadly, the logs (on API side) only show the following message:

[2022-09-19 08:29:58.902][30][trace][connection] [source/extensions/transport_sockets/tls/ssl_handshaker.cc:52] [C0] ssl error occurred while read: SSL
[2022-09-19 08:29:58.902][30][debug][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:228] [C0] remote address:172.22.0.12:39446,TLS error: 268435648:SSL routines:OPENSSL_internal:PEER_DID_NOT_RETURN_A_CERTIFICATE
[2022-09-19 08:29:58.902][30][debug][connection] [source/common/network/connection_impl.cc:250] [C0] closing socket: 0
[2022-09-19 08:29:58.903][30][debug][connection] [source/extensions/transport_sockets/tls/ssl_socket.cc:228] [C0] remote address:172.22.0.12:39446,TLS error: 268435648:SSL routines:OPENSSL_internal:PEER_DID_NOT_RETURN_A_CERTIFICATE
[2022-09-19 08:29:58.903][30][trace][connection] [source/common/network/connection_impl.cc:418] [C0] raising connection event 0

I have no idea why the app envoy does not send a certificate, nor why no additional logs are available.