Add better client error for client certificate failure (missing or denied)

This adds a more meaningful error on the client side so the "bad
certificate" error coming from the TLS dial code has some context for
the user.

Docker-DCO-1.1-Signed-off-by: Phil Estes <estesp@linux.vnet.ibm.com> (github: estesp)