ssl assumptions