encryption defaults empty :tls_options