Thankyou for that. I might contact Digicert and get one to test with. I can see a use case where tor proxy -> server needs TLS. Tor can not protect that last hop if it isn't on the same machine.