diff --git a/libp2p/multistream.nim b/libp2p/multistream.nim
index a0ca2f888..6d3bcdf99 100644
--- a/libp2p/multistream.nim
+++ b/libp2p/multistream.nim
@@ -45,7 +45,7 @@ proc select*(m: MultisteamSelect,
              conn: Connection,
              proto: seq[string]): 
              Future[string] {.async.} =
-  debug "select: initiating handshake"
+  debug "select: initiating handshake", codec = m.codec
   ## select a remote protocol
   await conn.write(m.codec) # write handshake
   if proto.len() > 0:
@@ -55,7 +55,7 @@ proc select*(m: MultisteamSelect,
   result = cast[string](await conn.readLp()) # read ms header
   result.removeSuffix("\n")
   if result != Codec:
-    debug "select: handshake failed"
+    debug "select: handshake failed", codec = result
     return ""
 
   if proto.len() == 0: # no protocols, must be a handshake call
diff --git a/libp2p/switch.nim b/libp2p/switch.nim
index f8156f8ec..3d483278c 100644
--- a/libp2p/switch.nim
+++ b/libp2p/switch.nim
@@ -15,7 +15,6 @@ import connection,
        multistream, 
        protocols/protocol,
        protocols/secure/secure, # for plain text
-       protocols/secure/secio,
        peerinfo, 
        multiaddress,
        protocols/identify, 
@@ -39,9 +38,14 @@ proc secure(s: Switch, conn: Connection): Future[Connection] {.async, gcsafe.} =
   ## secure the incoming connection
 
   # plaintext for now, doesn't do anything
+  let managers = s.secureManagers.mapIt(it.codec).deduplicate()
+  if managers.len == 0:
+    raise newException(CatchableError, "No secure managers registered!")
+
   if (await s.ms.select(conn, s.secureManagers.mapIt(it.codec))).len == 0:
     raise newException(CatchableError, "Unable to negotiate a secure channel!")
-  
+
+  var n = await s.secureManagers[0].secure(conn)
   result = conn
 
 proc identify(s: Switch, conn: Connection) {.async, gcsafe.} =
@@ -201,9 +205,14 @@ proc newSwitch*(peerInfo: PeerInfo,
     result.mount(val)
 
   for s in secureManagers:
+    debug "adding secure manager ", codec = s.codec
     result.secureManagers.add(s)
     result.mount(s)
 
   if result.secureManagers.len == 0:
     # use plain text if no secure managers are provided
-    result.mount(Secure(newPlainText()))
+    let manager = Secure(newPlainText())
+    result.mount(manager)
+    result.secureManagers.add(manager)
+
+  result.secureManagers = result.secureManagers.deduplicate()