Backport TLS fixes from #4293 to CMSSW_7_1_X