permanent server, ssl opt tweaks, config driven renewal