We should enable TLS by default and provide a config option (and a warning if disabled) to change that setting. Even better would be figuring out why it fails for some.