That's my mistake - I thought I had enabled that feature with tonic (ie. tls and tls-roots) but I hadn't. Apologies for wasing your time a bit