conn: move tls handshake to conn_tls()