diff --git a/src/server/server.c b/src/server/server.c
index 4d56917..c543260 100644
--- a/src/server/server.c
+++ b/src/server/server.c
@@ -195,7 +195,13 @@ int main(int argc, char *argv[]) {
     } else if (strcmp(argv[i], "--ca") == 0 && i + 1 < argc) {
       tls_ca = argv[++i];
     } else if (strcmp(argv[i], "-p") == 0 && i + 1 < argc) {
-      port = atoi(argv[++i]);
+      char *end;
+      long p = strtol(argv[++i], &end, 10);
+      if (*end || p <= 0 || p > 65535) {
+        fprintf(stderr, "Error: invalid port '%s' (must be 1-65535)\n", argv[i]);
+        return 1;
+      }
+      port = (int)p;
     } else if (argv[i][0] == '-') {
       fprintf(stderr, "Unknown option: %s\n", argv[i]);
       print_server_usage();
@@ -203,9 +209,8 @@ int main(int argc, char *argv[]) {
     }
   }
 
-  if (port < 1 || port > 65535) {
-    fprintf(stderr, "Error: port must be between 1 and 65535\n");
-    return 1;
+  if (tls_ca && !use_tls) {
+    log_message(LOG_LEVEL_WARNING, "--ca has no effect without --tls");
   }
 
   signal(SIGINT, cleanup);
diff --git a/src/shared/protocol.c b/src/shared/protocol.c
index 631c3a6..0081a20 100644
--- a/src/shared/protocol.c
+++ b/src/shared/protocol.c
@@ -10,7 +10,7 @@
 
 static __thread int io_read_fd = -1;
 static __thread int io_write_fd = -1;
-static __thread SSL *io_ssl = NULL;
+static SSL *io_ssl = NULL;
 
 static unsigned long long io_bwlimit = 0;
 static long long bw_tokens = 0;