fixes to TLS logic. Fewer warnings. tunnelTlsUseDer off if not specified