tls: handle `ssl.start()` errors