diff --git a/lib/pclsync/papi.c b/lib/pclsync/papi.c
index bc0fbee..18abab9 100644
--- a/lib/pclsync/papi.c
+++ b/lib/pclsync/papi.c
@@ -27,13 +27,15 @@
   EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+
 #include "papi.h"
 #include "plibs.h"
 #include "psettings.h"
 #include "psynclib.h"
 #include "ptimer.h"
-#include <stddef.h>
-#include <string.h>
 
 /*
   commented definitions are unused, but kept because they may be
@@ -105,8 +107,9 @@ psync_socket *psync_api_connect(const char *hostname, int usessl) {
   if (psync_timer_time() > notuntil || !userapi) {
     ret = psync_socket_connect(
         hostname, usessl ? PSYNC_API_PORT_SSL : PSYNC_API_PORT, usessl);
-    if (ret)
+    if (ret) {
       return ret;
+    }
     if (!userapi || !strcmp(hostname, userapi))
       return NULL;
     ret = psync_socket_connect(
diff --git a/lib/pclsync/pcompat.c b/lib/pclsync/pcompat.c
index f1aab86..c13c645 100644
--- a/lib/pclsync/pcompat.c
+++ b/lib/pclsync/pcompat.c
@@ -1088,9 +1088,12 @@ psync_socket *psync_socket_connect(const char *host, int unsigned port,
   psync_socket_t sock;
   char sport[8];
   psync_slprintf(sport, sizeof(sport), "%d", port);
+
   sock = connect_socket(host, sport);
-  if (unlikely_log(sock == INVALID_SOCKET))
+  if (unlikely_log(sock == INVALID_SOCKET)) {
     return NULL;
+  }
+
   if (ssl) {
     ssl = psync_ssl_connect(sock, &sslc, host);
     while (ssl == PSYNC_SSL_NEED_FINISH) {
@@ -1104,8 +1107,9 @@ psync_socket *psync_socket_connect(const char *host, int unsigned port,
       psync_close_socket(sock);
       return NULL;
     }
-  } else
+  } else {
     sslc = NULL;
+  }
   ret = psync_new(psync_socket);
   ret->ssl = sslc;
   ret->buffer = NULL;
diff --git a/lib/pclsync/pdiff.c b/lib/pclsync/pdiff.c
index 0eefaa6..34999b2 100644
--- a/lib/pclsync/pdiff.c
+++ b/lib/pclsync/pdiff.c
@@ -351,6 +351,7 @@ static psync_socket *get_connected_socket() {
 
     psync_set_status(PSTATUS_TYPE_AUTH, PSTATUS_AUTH_PROVIDED);
     saveauth = psync_setting_get_bool(_PS(saveauth));
+
     sock = psync_api_connect(apiserver, psync_setting_get_bool(_PS(usessl)));
 
     if (unlikely_log(!sock)) {
diff --git a/lib/pclsync/pssl.c b/lib/pclsync/pssl.c
index e059fd9..46e23b9 100644
--- a/lib/pclsync/pssl.c
+++ b/lib/pclsync/pssl.c
@@ -360,6 +360,7 @@ static int psync_ssl_check_peer_public_key(ssl_connection_t *conn) {
   return -1;
 }
 
+// FIXME
 int psync_ssl_connect(psync_socket_t sock, void **sslconn,
                       const char *hostname) {
   ssl_connection_t *conn;
@@ -372,6 +373,15 @@ int psync_ssl_connect(psync_socket_t sock, void **sslconn,
   mbedtls_net_init(&conn->srv);
   conn->sock = sock;
 
+  if ((ret = mbedtls_ssl_config_defaults(&conn->cfg, MBEDTLS_SSL_IS_CLIENT,
+                                         MBEDTLS_SSL_TRANSPORT_STREAM,
+                                         MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
+    debug(D_ERROR,
+          "failed to set ssl cfg defaults: ! mbedtls_ssl_config_defaults "
+          "returned %d\n\n",
+          ret);
+    goto err0;
+  }
   mbedtls_ssl_conf_endpoint(&conn->cfg, MBEDTLS_SSL_IS_CLIENT);
   mbedtls_ssl_conf_dbg(&conn->cfg, debug_cb, debug_ctx);
   mbedtls_ssl_conf_authmode(&conn->cfg, MBEDTLS_SSL_VERIFY_REQUIRED);
@@ -389,8 +399,9 @@ int psync_ssl_connect(psync_socket_t sock, void **sslconn,
 
   if ((sess = (mbedtls_ssl_session *)psync_cache_get(conn->cachekey))) {
     debug(D_NOTICE, "reusing cached session for %s", hostname);
-    if (mbedtls_ssl_set_session(&conn->ssl, sess))
+    if (mbedtls_ssl_set_session(&conn->ssl, sess)) {
       debug(D_WARNING, "ssl_set_session failed");
+    }
     mbedtls_ssl_session_free(sess);
     psync_free(sess);
   }
@@ -398,13 +409,16 @@ int psync_ssl_connect(psync_socket_t sock, void **sslconn,
   ret = mbedtls_ssl_handshake(&conn->ssl);
   if (ret == 0) {
     int result;
+
     if ((result = psync_ssl_check_peer_public_key(conn))) {
       goto err1;
     }
     *sslconn = conn;
+
     psync_ssl_save_session(conn);
     return PSYNC_SSL_SUCCESS;
   }
+
   psync_set_ssl_error(conn, ret);
   if (likely_log(ret == MBEDTLS_ERR_SSL_WANT_READ ||
                  ret == MBEDTLS_ERR_SSL_WANT_WRITE)) {
@@ -421,13 +435,18 @@ err0:
 int psync_ssl_connect_finish(void *sslconn, const char *hostname) {
   ssl_connection_t *conn;
   int ret;
+
   conn = (ssl_connection_t *)sslconn;
   ret = mbedtls_ssl_handshake(&conn->ssl);
   if (ret == 0) {
-    if (psync_ssl_check_peer_public_key(conn))
+    int result;
+    if ((result = psync_ssl_check_peer_public_key(conn))) {
       goto fail;
+    }
     psync_ssl_save_session(conn);
     return PSYNC_SSL_SUCCESS;
+  } else {
+    debug(D_ERROR, "handshake failed, return code was %d", ret);
   }
   psync_set_ssl_error(conn, ret);
   if (likely_log(ret == MBEDTLS_ERR_SSL_WANT_READ ||