This code [still] sucks.
Yes, Really.
Also, you'll need ClCertA.pem (common ssl key + cert) in the same directory.
You also need some identity shit, working on an app for that...until then you need to use a CFW system to mitm read the nasc request