ssl no longer hard-coded to off