strong TLS defaults, tweaked error handling