another round of ssl fixes