def query(db):
    """Query the database for hosts that require client certificates.

    Parameters
    ----------
    db : pymongo.database.Database
         The Mongo database connection

    Returns
    -------
    pymongo.cursor.Cursor: Essentially a generator for a list of
    dicts, each containing the pshtt scan results for a single host
    that requires authentication via client certificates.  The results
    are sorted by agency name.

    """
    client_cert_hosts = db.https_scan.find(
        {"latest": True, "live": True, "https_client_auth_required": True},
        {"_id": False, "latest": False},
    ).sort([("agency.name", 1)])

    return client_cert_hosts