fallback to openssl