more towards ssl, fancier contraint verifier