read the TLS data first, before the VPs