tls_wrap: return Error not throw for missing cert