OR default SSL_OP_LEGACY_SERVER_CONNECT so existing options are preserved