tls: a bit more work