support TLSv1 and whether strict hostname checking is enabled
drop errors into a list for access later