diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,9 @@
 # Revision history for hurl
 
+## 2.3.0.0 -- 2022-10-31
+* Fix MIMEtypes on error messages.
+* Fix overly-strict certificate validation, sacrificing clientside certificates.
+
 ## 2.2.0.0 -- 2022-08-06
 * Fix webform submission, refine API, & support multiple encodings.
 * Switch from OpenSSL to `tls`/Cryptonite for a cryptographic backend for better error reporting & to fix Gemini implementation
diff --git a/hurl.cabal b/hurl.cabal
--- a/hurl.cabal
+++ b/hurl.cabal
@@ -10,7 +10,7 @@
 -- PVP summary:      +-+------- breaking API changes
 --                   | | +----- non-breaking API additions
 --                   | | | +--- code changes with no API change
-version:             2.2.0.0
+version:             2.3.0.0
 
 -- A short (one-line) description of the package.
 synopsis:            Haskell URL resolver
diff --git a/src/Network/URI/Fetch.hs b/src/Network/URI/Fetch.hs
--- a/src/Network/URI/Fetch.hs
+++ b/src/Network/URI/Fetch.hs
@@ -148,7 +148,7 @@
     (ietfLocale, unixLocale) <- rfc2616Locale
     credentialsMVar <- newMVar Nothing
 #ifdef WITH_HTTP_URI
-    let httpsSettings = (TLS.defaultParamsClient "example.com" "https") {
+    {- let httpsSettings = (TLS.defaultParamsClient "example.com" "https") {
         TLS.clientSupported = def { TLS.supportedCiphers = TLS.ciphersuite_default },
         TLS.clientHooks = def {
             TLS.onCertificateRequest = deliverCredentials credentialsMVar
@@ -160,10 +160,11 @@
                 (\_ _ _ -> return TLS.ValidationCachePass)
                 (\_ _ _ -> return ())
         }
-    }
-    managerHTTP' <- HTTP.newManager $ TLS.mkManagerSettings (Conn.TLSSettings httpsSettings) Nothing
+    } -} -- FIXME: Be nice to support clientside certs... Those are far too strict!
+    managerHTTP' <- HTTP.newManager $ TLS.mkManagerSettings
+        (Conn.TLSSettingsSimple False False False) Nothing
     managerHTTPnovalidate' <- HTTP.newManager $ TLS.mkManagerSettings
-        (Conn.TLSSettings httpsSettingsNoValidate) Nothing 
+        (Conn.TLSSettingsSimple True False False) Nothing
 
     cookiesDir <- getXdgDirectory XdgData "nz.geek.adrian.hurl.cookies2"
     let cookiesPath' = cookiesDir </> appname
@@ -419,7 +420,7 @@
                 fetchURL' sess {
                     redirectCount = redirectCount sess - 1
                 } mimes $ relativeTo redirect' uri
-            (x, y, err) -> return (uri, mimeERR, Left $ Txt.pack $
+            (x, y, err) -> return (uri, htmlERR, Left $ Txt.pack $
                 trans' sess $ GeminiError x y $ Txt.unpack $
                     Txt.replace "<" "&lt;" $ Txt.replace "&" "&amp;" err)
     where
@@ -557,7 +558,7 @@
                         Just location <- lookup "location" $ HTTP.responseHeaders response,
                         Just uri' <- parseURIReference $ C8.unpack location ->
                     return $ Left $ relativeTo uri' uri
-                (Status code msg, "", _) -> return $ Right (Txt.pack mimeERR,
+                (Status code msg, "", _) -> return $ Right (Txt.pack htmlERR,
                     B.fromStrict $ C8.pack $
                         trans' session $ HTTPStatus code $ C8.unpack msg)
                 (_, body, (mimetype:_)) -> do
@@ -575,9 +576,9 @@
         Right (mime, body) ->
             let mime' = L.map (Txt.unpack . Txt.strip) $ Txt.splitOn ";" mime
             in return $ resolveCharset' uri mime' body
-  `catch` \e -> do return (rawUri, mimeERR, Left $ Txt.pack $ transHttp t e)
+  `catch` \e -> do return (rawUri, htmlERR, Left $ Txt.pack $ transHttp t e)
 fetchHTTPCached session _ [] uri _ _ =
-    return (uri, mimeERR, Left $ Txt.pack $ trans' session $ UnsupportedMIME "")
+    return (uri, htmlERR, Left $ Txt.pack $ trans' session $ UnsupportedMIME "")
 #endif
 
 #if WITH_HTTP_URI || WITH_GEMINI_URI