[core] allow earlier plugin init for SSL/TLS