require starttls if tls_socket is provided