connection: catch errors on upgraded tls socket