VPN Using AWS CDK

Question

I've been working on creating a VPN using AWS's CDK. I had to use Cloudformation lower level resources, as there doesn't seem to be any constructs yet. I believe I have the code set up correctly, as cdk diff doesn't show any errors. However, when running cdk deploy I get the following error:

CREATE_FAILED        | AWS::EC2::ClientVpnEndpoint                 | ClientVpnEndpoint2
Mutual authentication is required but is missing in the request (Service: AmazonEC2; Status Code: 400; Error Code: MissingParameter; Request ID: 5
384a1d9-ff60-4ac4-a1bc-df3a4db9146b; Proxy: null)

Which is odd... because I wouldn't think I'd need mutual authentication in order to create a VPN that uses mutual authentication. And if that is the case, then how do I get the aws cdk stack to use mutual authentication on deployment? Here is the relevant code I have:

        client_cert = certificate_manager.Certificate.from_certificate_arn(
            self,
            "ServerCertificate",
            self.cert_arn,
        )
        server_cert = certificate_manager.Certificate.from_certificate_arn(
            self,
            "ClientCertificate",
            self.client_arn,
        )
        log_group = logs.LogGroup(
            self,
            "ClientVpnLogGroup",
            retention=logs.RetentionDays.ONE_MONTH
        )
        log_stream = log_group.add_stream("ClientVpnLogStream")
        endpoint = ec2.CfnClientVpnEndpoint(
            self,
            "ClientVpnEndpoint2",
            description="VPN",
            authentication_options=[{
                "type": "certificate-authentication",
                "mutual_authentication": {
                    "client_root_certificate_chain_arn": client_cert.certificate_arn
                }
            }],
            tag_specifications=[{
                "resourceType": "client-vpn-endpoint",
                "tags": [{
                    "key": "Name",
                    "value": "Swyp VPN CDK created"
                }]
            }],
            client_cidr_block="10.27.0.0/20",
            connection_log_options={
                "enabled": True,
                "cloudwatch_log_group": log_group.log_group_name,
                "cloudwatch_log_stream": log_stream.log_stream_name,
            },
            server_certificate_arn=server_cert.certificate_arn,
            split_tunnel=False,
            vpc_id=vpc.vpc_id,
            dns_servers=["8.8.8.8", "8.8.4.4"],
        )
        dependables = core.ConcreteDependable()
        for i, subnet in enumerate(vpc.isolated_subnets):
            network_asc = ec2.CfnClientVpnTargetNetworkAssociation(
                self,
                "ClientVpnNetworkAssociation-" + str(i),
                client_vpn_endpoint_id=endpoint.ref,
                subnet_id=subnet.subnet_id,
            )
            dependables.add(network_asc)

        auth_rule = ec2.CfnClientVpnAuthorizationRule(
            self,
            "ClientVpnAuthRule",
            client_vpn_endpoint_id=endpoint.ref,
            target_network_cidr="0.0.0.0/0",
            authorize_all_groups=True,
            description="Allow all"
        )

        # add routes for subnets in order to surf internet (useful while splitTunnel is off)
        for i, subnet in enumerate(vpc.isolated_subnets):
            ec2.CfnClientVpnRoute(
                self,
                "CfnClientVpnRoute" + str(i),
                client_vpn_endpoint_id=endpoint.ref,
                destination_cidr_block="0.0.0.0/0",
                description="Route to all",
                target_vpc_subnet_id=subnet.subnet_id,
            ).node.add_dependency(dependables)

Maybe this is something simple like needing to update IAM policies? I'm fairly new to aws, aws cdk/cloudformation, and devops in general. So any insight would be much appreciated!