describe TLS status/nginx rationale