a better way to do SSL upgrade/downgrade