tls: throw an error, but a string