more robustly handle TLS negotation errors