switch to socat and use only TLSv1