Comment 1 for bug 1917094

I believe the correct place to fix this is in interface-tls-certificates. The joined method[1] should be replaced with an implementation of manage_flags[2], which is guaranteed to be called before reactive handlers run. That would ensure that certificates.server.cert.available is cleared before layer-tls-client handlers have a chance to run.

[1]: https://github.com/charmed-kubernetes/interface-tls-certificates/blob/d9850016d930a6d507b9fd45e2598d327922b140/requires.py#L79-L80
[2]: https://github.com/juju-solutions/charms.reactive/blob/f4f5ac61713a5544c3c522fa5873157a383241d7/charms/reactive/endpoints.py#L253