diff --git a/internal/command/context/create.go b/internal/command/context/create.go
index 68bd9f6..83412dd 100644
--- a/internal/command/context/create.go
+++ b/internal/command/context/create.go
@@ -113,13 +113,18 @@ func tryToConnectToTheController(
 	bootstrapToken *bootstraptoken.BootstrapToken,
 ) (*x509.Certificate, error) {
 	if !noPKI {
-		if err := tryToConnectWithPKI(ctx, controllerURL); err == nil {
+		fmt.Println("trying to connect to the controller using PKI and host's root CA set...")
+
+		err := tryToConnectWithPKI(ctx, controllerURL)
+		if err == nil {
 			// Connection successful and no certificate retrieval is needed
 			return nil, nil
 		} else if errors.Is(err, clientpkg.ErrAPI) {
 			// Makes no sense to go any further since it's an upper layer (HTTP, not TLS) error
 			return nil, err
 		}
+
+		fmt.Printf("PKI association failed (%v), falling back to trusted-certificate approach...\n", err)
 	}
 
 	return tryToConnectWithTrustedCertificate(ctx, controllerURL, bootstrapToken)
diff --git a/pkg/client/client.go b/pkg/client/client.go
index e37c141..1937f1c 100644
--- a/pkg/client/client.go
+++ b/pkg/client/client.go
@@ -10,7 +10,6 @@ import (
 	"errors"
 	"fmt"
 	"github.com/cirruslabs/orchard/internal/config"
-	"github.com/cirruslabs/orchard/internal/netconstants"
 	"github.com/cirruslabs/orchard/internal/version"
 	"github.com/cirruslabs/orchard/rpc"
 	"google.golang.org/grpc/credentials"
@@ -69,7 +68,10 @@ func New(opts ...Option) (*Client, error) {
 		client.tlsConfig = &tls.Config{
 			MinVersion: tls.VersionTLS12,
 			RootCAs:    privatePool,
-			ServerName: netconstants.DefaultControllerServerName,
+		}
+
+		if len(client.trustedCertificate.DNSNames) != 0 {
+			client.tlsConfig.ServerName = client.trustedCertificate.DNSNames[0]
 		}
 	}
 
@@ -170,10 +172,7 @@ func (client *Client) request(
 		body = bytes.NewBuffer(jsonBytes)
 	}
 
-	endpointURL, err := client.parsePath(path)
-	if err != nil {
-		return err
-	}
+	endpointURL := client.formatPath(path)
 
 	values := endpointURL.Query()
 	for key, value := range params {
@@ -242,10 +241,7 @@ func (client *Client) wsRequest(
 	path string,
 	params map[string]string,
 ) (net.Conn, error) {
-	endpointURL, err := client.parsePath(path)
-	if err != nil {
-		return nil, err
-	}
+	endpointURL := client.formatPath(path)
 
 	// Adapt HTTP scheme to WebSocket scheme
 	if client.insecure {
@@ -283,19 +279,14 @@ func (client *Client) wsRequest(
 	return websocket.NetConn(ctx, conn, websocket.MessageBinary), nil
 }
 
-func (client *Client) parsePath(path string) (*url.URL, error) {
-	endpointURL, err := url.Parse("v1/" + path)
-	if err != nil {
-		return nil, fmt.Errorf("%w to parse API endpoint path: %v", ErrFailed, err)
+func (client *Client) formatPath(path string) *url.URL {
+	endpointURL := &url.URL{
+		Scheme: client.baseURL.Scheme,
+		User:   client.baseURL.User,
+		Host:   client.baseURL.Host,
 	}
 
-	return &url.URL{
-		Scheme:  client.baseURL.Scheme,
-		User:    client.baseURL.User,
-		Host:    client.baseURL.Host,
-		Path:    endpointURL.Path,
-		RawPath: endpointURL.RawPath,
-	}, nil
+	return endpointURL.JoinPath("v1", path)
 }
 
 func (client *Client) modifyHeader(header http.Header) {