much improved tls handling