function newTlsOptions (hostname, ca = undefined, clientCertificate = undefined) {
  return {
    rejectUnauthorized: false, // we manually check for this in the connect callback, to give a more helpful error to the user
    servername: hostname, // server name for the SNI (Server Name Indication) TLS extension
    ca, // optional CA useful for TRUST_CUSTOM_CA_SIGNED_CERTIFICATES trust mode,
    ...clientCertificate
  }
}
Create a new configuration options object for the {@code tls.connect()} call.
@param {string} hostname the target hostname.
@param {string|undefined} ca an optional CA.
@param {string|undefined} cert an optional client cert.
@param {string|undefined} key an optional client cert key.
@param {string|undefined} passphrase an optional client cert passphrase
@return {Object} a new options object.