external API use SSL_FATAL_ERROR instead of -1 cases