better handling of old versions of OpenSSL and errors getting certs