OpenSSL is not IDNA aware (see RFC5890). So essentially you need to do any punycode transformation prior to using OpenSSL. This is a bit rubbish and we should implement this. But it won't happen in the 1.1.1 timeframe. Marking this as a feature request for post-1.1.1.