section 7.6.4 (left out ssl in prod so far)