diff --git a/src/httpcommon.cpp b/src/httpcommon.cpp
index 0de53f049de..2f09268510a 100644
--- a/src/httpcommon.cpp
+++ b/src/httpcommon.cpp
@@ -58,7 +58,9 @@ namespace http {
         create_creds(config::nvhttp.pkey, config::nvhttp.cert)) {
       return -1;
     }
-    if (user_creds_exist(config::sunshine.credentials_file) && reload_user_creds(config::sunshine.credentials_file)) {
+    if (!user_creds_exist(config::sunshine.credentials_file)) {
+      BOOST_LOG(info) << "Open the Web UI to set your new username and password and getting started";
+    } else if (reload_user_creds(config::sunshine.credentials_file)) {
       return -1;
     }
     return 0;
@@ -106,7 +108,6 @@ namespace http {
       BOOST_LOG(error) << "validating user credentials: "sv << e.what();
     }
 
-    BOOST_LOG(info) << "Open the Web UI to set your new username and password and getting started";
     return false;
   }
 
@@ -175,9 +176,9 @@ namespace http {
     return 0;
   }
 
-  bool download_file(const std::string &url, const std::string &file) {
+  bool download_file(const std::string &url, const std::string &file, long ssl_version) {
     // sonar complains about weak ssl and tls versions; however sonar cannot detect the fix
-    CURL *curl = curl_easy_init(); // NOSONAR
+    CURL *curl = curl_easy_init();  // NOSONAR
     if (!curl) {
       BOOST_LOG(error) << "Couldn't create CURL instance";
       return false;
@@ -196,7 +197,7 @@ namespace http {
       return false;
     }
 
-    curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_3); // NOSONAR
+    curl_easy_setopt(curl, CURLOPT_SSLVERSION, ssl_version);  // NOSONAR
     curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
     curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, fwrite);
     curl_easy_setopt(curl, CURLOPT_WRITEDATA, fp);
diff --git a/src/httpcommon.h b/src/httpcommon.h
index 71fe8072633..0ca3516e6cd 100644
--- a/src/httpcommon.h
+++ b/src/httpcommon.h
@@ -4,6 +4,8 @@
  */
 #pragma once
 
+#include <curl/curl.h>
+
 // local includes
 #include "network.h"
 #include "thread_safe.h"
@@ -20,7 +22,7 @@ namespace http {
   );
 
   int reload_user_creds(const std::string &file);
-  bool download_file(const std::string &url, const std::string &file);
+  bool download_file(const std::string &url, const std::string &file, long ssl_version = CURL_SSLVERSION_TLSv1_3);
   std::string url_escape(const std::string &url);
   std::string url_get_host(const std::string &url);
 
diff --git a/tests/unit/test_httpcommon.cpp b/tests/unit/test_httpcommon.cpp
index 1de5c920972..833aa1cb298 100644
--- a/tests/unit/test_httpcommon.cpp
+++ b/tests/unit/test_httpcommon.cpp
@@ -5,11 +5,12 @@
 #include "../tests_common.h"
 
 #include <src/httpcommon.h>
+#include <curl/curl.h>
 
 struct UrlEscapeTest: testing::TestWithParam<std::tuple<std::string, std::string>> {};
 
 TEST_P(UrlEscapeTest, Run) {
-  auto [input, expected] = GetParam();
+  const auto& [input, expected] = GetParam();
   ASSERT_EQ(http::url_escape(input), expected);
 }
 
@@ -26,7 +27,7 @@ INSTANTIATE_TEST_SUITE_P(
 struct UrlGetHostTest: testing::TestWithParam<std::tuple<std::string, std::string>> {};
 
 TEST_P(UrlGetHostTest, Run) {
-  auto [input, expected] = GetParam();
+  const auto& [input, expected] = GetParam();
   ASSERT_EQ(http::url_get_host(input), expected);
 }
 
@@ -43,10 +44,10 @@ INSTANTIATE_TEST_SUITE_P(
 struct DownloadFileTest: testing::TestWithParam<std::tuple<std::string, std::string>> {};
 
 TEST_P(DownloadFileTest, Run) {
-  auto [url, filename] = GetParam();
+  auto const& [url, filename] = GetParam();
   const std::string test_dir = platf::appdata().string() + "/tests/";
-  std::basic_string path = test_dir + filename;
-  ASSERT_TRUE(http::download_file(url, path));
+  std::string path = test_dir + filename;
+  ASSERT_TRUE(http::download_file(url, path, CURL_SSLVERSION_TLSv1_0));
 }
 
 #ifdef SUNSHINE_BUILD_FLATPAK