Use null internally if a user specified an empty cipherspec