allow configurable outbound TLS