ssl: add ordering requirement