anchor.diff:  {
       protected override ConnectionSettings ConnectionSettings(ConnectionSettings s) => s
           .ServerCertificateValidationCallback((o, certificate, chain, errors) => false)
  -        .ServerCertificateValidationCallback(CertificateValidations.DenyAll); <1>
  +        .ServerCertificateValidationCallback(CertificateValidations.DenyAll); <1>
   }
   ----
   <1> synonymous with the previous lambda expression
  
positive.code: ==== Client Certificates
  
  X-Pack also allows you to configure a {xpack_current}/pki-realm.html[PKI realm] to enable user authentication
  through client certificates. The {ref_current}/certutil.html[`certutil` tool] included with X-Pack allows you to
  generate client certificates as well and assign the distinguished name (DN) of the
  certificate to a user with a certain role.
  
  
negative.code: If your client application has access to the public CA certificate locally, Elasticsearch.NET and NEST ship with some handy helpers
  that can assert that a certificate the server presents is one that came from the local CA.
  
  If you use X-Pack's {ref_current}/certutil.html[+certutil+ tool] to generate SSL certificates, the generated node certificate
  does not include the CA in the certificate chain, in order to cut down on SSL handshake size. In those case you can use
  `CertificateValidations.AuthorityIsRoot` and pass it your local copy of the CA public key to assert that
  the certificate the server presented was generated using it
  