Dovecot proxy with TLS client certificate authentication only fails with "no auth attempts"

Similar to my previous Q&A in which I successfully set up an authenticating Dovecot IMAP proxy with Kerberos/GSSAPI, I want to do the same with TLS client certificates;

• My upstream (backend) IMAP server allows to authenticate without a password (trusts this Dovecot proxy to authenticate users properly).
• This Dovecot proxy is set up to validate a TLS client certificates and take the username from the Common Name field of the certificate.

The Dovecot configuration file:

# Default configuration will have it listen on IMAP tcp/143 with StartTLS required and IMAPS tcp/993 with TLS required.
protocols = imap

hostname = myhostname.domain.tld

passdb {
  driver = static
  # Backend IMAP server that accepts any/none password for a given user.
  args = proxy=y host=10.1.2.3 port=9999 pass=masterpass nopassword=y
}

# Deliberately omitted userdb, because this is a proxy.

# local username only
auth_username_format = %n

# Logging to foreground with some verbose logging for authentication.
log_path = /dev/stderr
auth_verbose = yes
verbose_ssl = yes
auth_debug = yes

ssl = required
ssl_cert = </etc/dovecot-ssl/cert.crt
ssl_key = </etc/dovecot-ssl/key.pem
ssl_prefer_server_ciphers = yes
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ECDHE-ECDSA-AES128-GCM-SHA256:[... omitted for brevity ...]

# SSL client certificate authentication required (no password required by client).
# https://doc.dovecot.org/configuration_manual/dovecot_ssl_configuration/#client-certificate-verification-authentication
ssl_ca = </etc/dovecot-ssl/client-ca.crt
ssl_verify_client_cert = yes
auth_ssl_require_client_cert = yes
# I don't have CRL set up at this point (will do later) and Dovecot requires to disable CRL check or else it fails.
ssl_require_crl = no

# Take the username from the client certificate (CN)
auth_ssl_username_from_cert = yes
ssl_cert_username_field = commonName

This works really well, except for one thing: the clients are still required to provide a bogus username/password. ?

I would have expected to be able to omit username/password in IMAP clients (authentication type = client cert), e.g. K-9 mail.

Server side error in logs shows a no auth attempts info level logged error message:

[...]
Apr 27 18:37:57 imap-login: Info: Received valid SSL certificate: [...]
[...]
Apr 27 18:37:57 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully
Apr 27 18:37:57 imap-login: Debug: SSL alert: close notify
Apr 27 18:37:57 imap-login: Info: Disconnected (no auth attempts in 0 secs): user=<>, rip=10.9.9.9, lip=10.1.2.4, TLS, session=<Yw6fj/jA1JsKMgB0>
Apr 27 18:37:57 imap-login: Debug: SSL alert: close notify

When setting a bogus username+password, the login seems to work, though:

[...]
Apr 27 18:33:36 imap-login: Debug: SSL: where=0x2002, ret=1: SSL negotiation finished successfully
Apr 27 18:33:36 imap-login: Info: proxy(gert): started proxying to 10.1.2.3:9999: user=<gert>, method=PLAIN, rip=10.9.9.9, lip=10.1.2.4, TLS, session=<bSMSgPjA0psKMgB0>

So, bottom line my question is: how do I configure Dovecot to log in with TLS client certificate only and to avoid having to tell my users to pick a random password?

I've tried:

• setting nologin=y as passdb arg option, but that does not seem to have any effect.
• set auth_mechanisms = anonymous, but that does not seem to have any effect.
• set auth_mechanisms = (empty), but that fails any connection with auth: Fatal: No authentication mechanisms configured