note that we don't use attached openssl by default