I had trouble for connecting with a client that does not handle TLS (like ii, sic, ...), and I found a solution! :)

I use an inetd stream entry which for piping the command-line TLS client* and a local TCP socket for your client to connect to. You can even have a Proxy machine which does the translation!

* openssl s_client, nc -ssl, brssl client... now you have the choice of your backend! :D Pipes are universal.

# vi /etc/services

# vi /etc/inetd.conf

And then start the inetd service, the inetd daemon... however you distro or you wants it... If it already runs, you can probably reload its configuration with:
# pkill -HUP inetd

You can pretty much use xinetd for this, the command itox translates the inetd format to xinetd format:
# itox < inetd.conf