move internal functions to ssl_locl.h