diff --git a/ChangeLog b/ChangeLog
index 10aea36..e8f63d1 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -41,6 +41,7 @@
      default ciphersuite list returned by ssl_list_ciphersuites()
    * Support for receiving SSLv2 ClientHello is now disabled by default at
      compile time.
+   * The default authmode for SSL/TLS clients is now REQUIRED.
 
 Changes
    * Remove test program o_p_test, the script compat.sh does more.
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 2642ac6..abe004c 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -1156,8 +1156,9 @@
  * \param ssl      SSL context
  * \param authmode can be:
  *
- *  SSL_VERIFY_NONE:      peer certificate is not checked (default),
- *                        this is insecure and SHOULD be avoided.
+ *  SSL_VERIFY_NONE:      peer certificate is not checked
+ *                        (default on server)
+ *                        (insecure on client)
  *
  *  SSL_VERIFY_OPTIONAL:  peer certificate is checked, however the
  *                        handshake continues even if verification failed;
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 25f3a02..e877315 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -5195,7 +5195,10 @@
 #if defined(POLARSSL_SSL_SESSION_TICKETS) && \
     defined(POLARSSL_SSL_CLI_C)
     if( endpoint == SSL_IS_CLIENT )
+    {
         ssl->session_tickets = SSL_SESSION_TICKETS_ENABLED;
+        ssl->authmode = SSL_VERIFY_REQUIRED;
+    }
 #endif
 
 #if defined(POLARSSL_SSL_TRUNCATED_HMAC)
diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index 93ab15b..9259976 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -86,7 +86,7 @@
 #define DFL_MIN_VERSION         SSL_MINOR_VERSION_1
 #define DFL_MAX_VERSION         -1
 #define DFL_ARC4                -1
-#define DFL_AUTH_MODE           SSL_VERIFY_REQUIRED
+#define DFL_AUTH_MODE           -1
 #define DFL_MFL_CODE            SSL_MAX_FRAG_LEN_NONE
 #define DFL_TRUNC_HMAC          -1
 #define DFL_RECSPLIT            -1
@@ -229,7 +229,7 @@
     "\n"                                                    \
     USAGE_DTLS                                              \
     "\n"                                                    \
-    "    auth_mode=%%s        default: \"required\"\n"      \
+    "    auth_mode=%%s        default: (library default: none)\n"      \
     "                        options: none, optional, required\n" \
     USAGE_IO                                                \
     "\n"                                                    \
@@ -249,7 +249,7 @@
     USAGE_ETM                                               \
     USAGE_RECSPLIT                                          \
     "\n"                                                    \
-    "    arc4=%%d             default: (library default)\n" \
+    "    arc4=%%d             default: (library default: 0)\n" \
     "    min_version=%%s      default: \"\" (ssl3)\n"       \
     "    max_version=%%s      default: \"\" (tls1_2)\n"     \
     "    force_version=%%s    default: \"\" (none)\n"       \
@@ -1074,7 +1074,8 @@
 #endif
 
     ssl_set_endpoint( &ssl, SSL_IS_CLIENT );
-    ssl_set_authmode( &ssl, opt.auth_mode );
+    if( opt.auth_mode != DFL_AUTH_MODE )
+        ssl_set_authmode( &ssl, opt.auth_mode );
 
 #if defined(POLARSSL_SSL_PROTO_DTLS)
     if( ( ret = ssl_set_transport( &ssl, opt.transport ) ) != 0 )
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index 8a3010f..c2beec7 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -102,7 +102,7 @@
 #define DFL_MIN_VERSION         SSL_MINOR_VERSION_1
 #define DFL_MAX_VERSION         -1
 #define DFL_ARC4                -1
-#define DFL_AUTH_MODE           SSL_VERIFY_OPTIONAL
+#define DFL_AUTH_MODE           -1
 #define DFL_MFL_CODE            SSL_MAX_FRAG_LEN_NONE
 #define DFL_TRUNC_HMAC          -1
 #define DFL_TICKETS             SSL_SESSION_TICKETS_ENABLED
@@ -296,7 +296,7 @@
     USAGE_ANTI_REPLAY                                       \
     USAGE_BADMAC_LIMIT                                      \
     "\n"                                                    \
-    "    auth_mode=%%s        default: \"optional\"\n"      \
+    "    auth_mode=%%s        default: (library default: required)\n"      \
     "                        options: none, optional, required\n" \
     USAGE_IO                                                \
     USAGE_SNI                                               \
@@ -315,7 +315,7 @@
     USAGE_EMS                                               \
     USAGE_ETM                                               \
     "\n"                                                    \
-    "    arc4=%%d             default: (library default)\n" \
+    "    arc4=%%d             default: (library default: 0)\n" \
     "    min_version=%%s      default: \"ssl3\"\n"          \
     "    max_version=%%s      default: \"tls1_2\"\n"        \
     "    force_version=%%s    default: \"\" (none)\n"       \
@@ -1524,7 +1524,8 @@
     }
 
     ssl_set_endpoint( &ssl, SSL_IS_SERVER );
-    ssl_set_authmode( &ssl, opt.auth_mode );
+    if( opt.auth_mode != DFL_AUTH_MODE )
+        ssl_set_authmode( &ssl, opt.auth_mode );
 
 #if defined(POLARSSL_SSL_PROTO_DTLS)
     if( ( ret = ssl_set_transport( &ssl, opt.transport ) ) != 0 )
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 82d1238..c42e98e 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -1164,7 +1164,7 @@
 # Tests for renegotiation
 
 run_test    "Renegotiation: none, for reference" \
-            "$P_SRV debug_level=3 exchanges=2" \
+            "$P_SRV debug_level=3 exchanges=2 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2" \
             0 \
             -C "client hello, adding renegotiation extension" \
@@ -1177,7 +1177,7 @@
             -S "write hello request"
 
 run_test    "Renegotiation: client-initiated" \
-            "$P_SRV debug_level=3 exchanges=2 renegotiation=1" \
+            "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1190,7 +1190,7 @@
             -S "write hello request"
 
 run_test    "Renegotiation: server-initiated" \
-            "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
+            "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1203,7 +1203,7 @@
             -s "write hello request"
 
 run_test    "Renegotiation: double" \
-            "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
+            "$P_SRV debug_level=3 exchanges=2 renegotiation=1 auth_mode=optional renegotiate=1" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1216,7 +1216,7 @@
             -s "write hello request"
 
 run_test    "Renegotiation: client-initiated, server-rejected" \
-            "$P_SRV debug_level=3 exchanges=2 renegotiation=0" \
+            "$P_SRV debug_level=3 exchanges=2 renegotiation=0 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
             1 \
             -c "client hello, adding renegotiation extension" \
@@ -1231,7 +1231,7 @@
             -c "failed"
 
 run_test    "Renegotiation: server-initiated, client-rejected, default" \
-            "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1" \
+            "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
             0 \
             -C "client hello, adding renegotiation extension" \
@@ -1247,7 +1247,7 @@
 
 run_test    "Renegotiation: server-initiated, client-rejected, not enforced" \
             "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
-             renego_delay=-1" \
+             renego_delay=-1 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
             0 \
             -C "client hello, adding renegotiation extension" \
@@ -1264,7 +1264,7 @@
 # delay 2 for 1 alert record + 1 application data record
 run_test    "Renegotiation: server-initiated, client-rejected, delay 2" \
             "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
-             renego_delay=2" \
+             renego_delay=2 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
             0 \
             -C "client hello, adding renegotiation extension" \
@@ -1280,7 +1280,7 @@
 
 run_test    "Renegotiation: server-initiated, client-rejected, delay 0" \
             "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
-             renego_delay=0" \
+             renego_delay=0 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=0" \
             0 \
             -C "client hello, adding renegotiation extension" \
@@ -1295,7 +1295,7 @@
 
 run_test    "Renegotiation: server-initiated, client-accepted, delay 0" \
             "$P_SRV debug_level=3 exchanges=2 renegotiation=1 renegotiate=1 \
-             renego_delay=0" \
+             renego_delay=0 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1310,7 +1310,7 @@
             -S "failed"
 
 run_test    "Renegotiation: periodic, just below period" \
-            "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \
+            "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=2 renegotiation=1" \
             0 \
             -C "client hello, adding renegotiation extension" \
@@ -1327,7 +1327,7 @@
 
 # one extra exchange to be able to complete renego
 run_test    "Renegotiation: periodic, just above period" \
-            "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \
+            "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1343,7 +1343,7 @@
             -S "failed"
 
 run_test    "Renegotiation: periodic, two times period" \
-            "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3" \
+            "$P_SRV debug_level=3 exchanges=9 renegotiation=1 renego_period=3 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=7 renegotiation=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1359,7 +1359,7 @@
             -S "failed"
 
 run_test    "Renegotiation: periodic, above period, disabled" \
-            "$P_SRV debug_level=3 exchanges=9 renegotiation=0 renego_period=3" \
+            "$P_SRV debug_level=3 exchanges=9 renegotiation=0 renego_period=3 auth_mode=optional" \
             "$P_CLI debug_level=3 exchanges=4 renegotiation=1" \
             0 \
             -C "client hello, adding renegotiation extension" \
@@ -1375,7 +1375,7 @@
             -S "failed"
 
 run_test    "Renegotiation: nbio, client-initiated" \
-            "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
+            "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 auth_mode=optional" \
             "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
             0 \
             -c "client hello, adding renegotiation extension" \
@@ -1388,7 +1388,7 @@
             -S "write hello request"
 
 run_test    "Renegotiation: nbio, server-initiated" \
-            "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1" \
+            "$P_SRV debug_level=3 nbio=2 exchanges=2 renegotiation=1 renegotiate=1 auth_mode=optional" \
             "$P_CLI debug_level=3 nbio=2 exchanges=2 renegotiation=1" \
             0 \
             -c "client hello, adding renegotiation extension" \