Does the NATS server reuse the same CA file for both server and client verification when mutual TLS is enabled?

When running a NATS server locally with mutual TLS, administrators often point both the server certificate and the client verification trust store to the same self‑signed CA file, and connections succeed. In a production environment that uses a certificate chain signed by a public or internal CA, the same configuration sometimes fails because the server appears to reject client certificates even when they are signed by the trusted chain. The uncertainty lies in whether the `--tlsverify` flag causes the server to treat the supplied CA file as the sole source of trust for both presenting its own certificate and validating incoming client certificates, or whether a separate client‑auth CA must be configured. Clarifying this behavior is essential for moving a working local TLS setup to production without introducing authentication errors.

Does the server consider the CA file provided via `--tlsverify` sufficient for both server‑side certificate presentation and client‑certificate validation? Or must a distinct client‑auth CA be supplied via a separate configuration option?