diff --git a/network/agent/agent.spec.ts b/network/agent/agent.spec.ts
index f26f6ee..5f3429c 100644
--- a/network/agent/agent.spec.ts
+++ b/network/agent/agent.spec.ts
@@ -207,7 +207,7 @@ test('select correct client certificates when host has a path', () => {
 test('select correct client certificates when host has a path and the cert contains a path', () => {
   const agent = getAgent('https://foo.com/bar/baz', {
     clientCertificates: {
-      '//foo.com/bar': {
+      '//foo.com/bar/': {
         ca: 'ca',
         cert: 'cert',
         key: 'key',
diff --git a/network/agent/agent.ts b/network/agent/agent.ts
index 4d3996b..484255e 100644
--- a/network/agent/agent.ts
+++ b/network/agent/agent.ts
@@ -23,14 +23,14 @@ export function getAgent (uri: string, opts: AgentOptions) {
 }
 
 function getClientCertificates(uri: string, opts: AgentOptions) {
-  const { host, hostOnlyDomain, pathname } = parseUri(uri)
+  const { host, hostOnlyDomain, pathname, nerf } = parseUri(uri)
 
   if (host.endsWith(pathname)) {
     return opts.clientCertificates?.[host];
   }
 
-  const fullPath = `${host}${pathname !== '/' ? pathname : ''}`;
-  return opts.clientCertificates?.[fullPath] ?? opts.clientCertificates?.[host] ?? opts.clientCertificates?.[hostOnlyDomain];
+  const fullPath = `${nerf}${pathname !== '/' ? pathname : ''}`;
+  return opts.clientCertificates?.[fullPath] ?? opts.clientCertificates?.[nerf] ?? opts.clientCertificates?.[hostOnlyDomain];
 }
 
 function getNonProxyAgent (uri: string, opts: AgentOptions) {