hsa: add support for tls to proxy