remove penalty from envelope, it no longer exists
only enable SNI if openssl supports it