use OpenSSL directly