disable softfail by default (in line with documentation)
add HTTP Host: header in OCSP request