diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Changelog
 
+## [1.1.0.0] - 2018-11-04
+
+### Changed
+
+- GHC 8.6.x support
+
+### Removed
+
+- Plain unencrypted (non-TLS) connections to AES server are no longer supported
+
 ## [1.0.0.1] - 2018-05-10
 
 ### Changed
@@ -8,5 +18,6 @@
 
 ## [1.0.0.0] - 2018-05-10
 
+[1.1.0.0]: https://github.com/f-me/dmcc/compare/1.0.0.1...1.1.0.0
 [1.0.0.1]: https://github.com/f-me/dmcc/compare/1.0.0.0...1.0.0.1
 [1.0.0.0]: https://github.com/f-me/dmcc/tree/1.0.0.0
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -45,18 +45,23 @@
 is to provide a clean agent-centric interface to DMCC API suitable for
 usage from client applications running in a browser.
 
-The server is invoked as `dmcc-ws dmcc-ws.cfg`. See example
-configuration file at `dmcc-ws/example.cfg`.
+Run the server as
 
+```
+dmcc-ws dmcc-ws.cfg
+```
+
+See example configuration file at `dmcc-ws/example.cfg`.
+
 With `dmcc-ws` running, you may start controlling an agent with
-extension `XXX`, connect to WebSocket URL `http://host:port/XXX`. The
-server accepts client commands in JSON:
+extension `XXX` by connecting to WebSocket URL `http://host:port/XXX`.
+The server accepts client commands in JSON:
 
 ```json
 {"action":"MakeCall", "number":"989150603267"}
 ```
 
-Consult `DMCC.Action` documentation in Haddock docs for DMCC library
+Consult [`DMCC.Action`][dmcc-actions] documentation in Haddock docs for DMCC library
 for supported commands.
 
 The server reports telephony events along with updated agent snapshot:
@@ -104,3 +109,5 @@
 [dmcc-api]: https://www.devconnectprogram.com/site/global/products_resources/avaya_aura_application_enablement_services/interfaces/dmcc/overview/index.gsp
 
 [ecma-354]: http://www.ecma-international.org/publications/standards/Ecma-354.htm
+
+[dmcc-actions]: https://hackage.haskell.org/package/dmcc/docs/DMCC-Agent.html#t:Action
diff --git a/dmcc-ws/Main.hs b/dmcc-ws/Main.hs
--- a/dmcc-ws/Main.hs
+++ b/dmcc-ws/Main.hs
@@ -41,7 +41,6 @@
   { listenPort :: Int
   , aesAddr    :: String
   , aesPort    :: Int
-  , aesTLS     :: Bool
   , caDir      :: Maybe FilePath
   , apiUser    :: Text
   , apiPass    :: Text
@@ -88,7 +87,6 @@
       <$> Cfg.require c "listen-port"
       <*> Cfg.require c "aes-addr"
       <*> Cfg.require c "aes-port"
-      <*> Cfg.lookupDefault True c "aes-use-tls"
       <*> Cfg.lookup  c "aes-cacert-directory"
       <*> Cfg.require c "api-user"
       <*> Cfg.require c "api-pass"
@@ -105,8 +103,7 @@
   CS.logInfo $ "Starting session using " <> fromString (show cfg)
 
   let runSession = startSession
-        (aesAddr, fromIntegral aesPort)
-        (if aesTLS then TLS caDir else Plain)
+        (aesAddr, fromIntegral aesPort) caDir
         apiUser apiPass
         whUrl
         defaultSessionOptions { statePollingDelay       = stateDelay
diff --git a/dmcc-ws/example.cfg b/dmcc-ws/example.cfg
--- a/dmcc-ws/example.cfg
+++ b/dmcc-ws/example.cfg
@@ -1,20 +1,19 @@
-listen-port = 8333
-
 aes-addr = "192.168.20.14"
 aes-port = 4722
-aes-use-tls = true
 
 # Path to a directory which contains the PEM encoded CA root
 # certificates used to verify server certificate. See
 # http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html
 # for details of the file naming scheme
-#
-# aes-cacert-directory = "/etc/ssl/csta-certs/"
+aes-cacert-directory = "/etc/ssl/csta-certs/"
 
 api-user = "avaya"
 api-pass = "avayapassword"
 
 switch-name = "ADACs8300"
+
+# Expose WebSocket interface on this port
+listen-port = 8333
 
 # Log low-level CSTA library requests/responses
 log-library = false
diff --git a/dmcc.cabal b/dmcc.cabal
--- a/dmcc.cabal
+++ b/dmcc.cabal
@@ -1,6 +1,6 @@
-cabal-version: >=1.10
+cabal-version: 1.12
 name: dmcc
-version: 1.0.0.1
+version: 1.1.0.0
 license: BSD3
 license-file: LICENSE
 maintainer: dima@dzhus.org
@@ -14,8 +14,8 @@
 build-type: Simple
 extra-source-files:
     CHANGELOG.md
-    dmcc-ws/example.cfg
     README.md
+    dmcc-ws/example.cfg
 
 source-repository head
     type: git
@@ -42,22 +42,22 @@
     ghc-options: -Wall -Wcompat -Wno-missing-home-modules
     build-depends:
         HsOpenSSL <0.12,
-        aeson <1.3,
-        base <4.12,
+        aeson <1.5,
+        base <4.13,
         binary <0.9,
         bytestring <0.11,
         case-insensitive <1.3,
-        classy-prelude <1.5,
-        containers <0.6,
+        classy-prelude <1.6,
+        containers <0.7,
         http-client <0.6,
         io-streams <1.6,
-        lens <4.17,
+        lens <4.18,
         monad-control <1.1,
         monad-logger <0.4,
-        network <2.7,
+        network <2.9,
         openssl-streams <1.3,
         safe-exceptions <0.2,
-        stm <2.5,
+        stm <2.6,
         text <1.3,
         time <1.9,
         transformers-base <0.5,
@@ -75,17 +75,17 @@
                         NamedFieldPuns NoImplicitPrelude
     ghc-options: -Wall -Wcompat -Wno-missing-home-modules -threaded
     build-depends:
-        aeson <1.3,
-        base <4.12,
+        aeson <1.5,
+        base <4.13,
         bytestring <0.11,
-        classy-prelude <1.5,
+        classy-prelude <1.6,
         configurator <0.4,
-        containers <0.6,
+        containers <0.7,
         dmcc -any,
         monad-control <1.1,
         monad-logger <0.4,
         random <1.2,
-        stm <2.5,
+        stm <2.6,
         text <1.3,
         unix <2.8,
         unliftio <0.3,
diff --git a/src/DMCC.hs b/src/DMCC.hs
--- a/src/DMCC.hs
+++ b/src/DMCC.hs
@@ -7,7 +7,6 @@
 
 module DMCC
   ( Session
-  , ConnectionType (..)
   , startSession
   , stopSession
   , defaultSessionOptions
diff --git a/src/DMCC/Agent.hs b/src/DMCC/Agent.hs
--- a/src/DMCC/Agent.hs
+++ b/src/DMCC/Agent.hs
@@ -394,7 +394,7 @@
       sendRequestSync (dmccHandle as) (Just aid) $
       Rq.GenerateDigits digits device callId (protocolVersion as)
     SetState newState -> do
-      cs <- atomically $ readTVar snapshot
+      cs <- readTVarIO snapshot
       when (fst (_state cs) /= Just Busy) $
         simpleRequest Rq.SetAgentState newState
   where
@@ -607,7 +607,7 @@
 -- | Attach an event handler to an agent. Exceptions are not handled.
 handleEvents :: (MonadLoggerIO m, MonadThrow m) => AgentHandle -> (AgentEvent -> m ()) -> m ThreadId
 handleEvents (AgentHandle (aid, as)) handler = do
-  ags <- atomically $ readTVar $ agents as
+  ags <- readTVarIO $ agents as
   case Map.lookup aid ags of
     Nothing -> throwIO $ UnknownAgent aid
     Just Agent{..} -> do
diff --git a/src/DMCC/Session.hs b/src/DMCC/Session.hs
--- a/src/DMCC/Session.hs
+++ b/src/DMCC/Session.hs
@@ -1,4 +1,5 @@
 {-# LANGUAGE BangPatterns #-}
+{-# LANGUAGE CPP #-}
 {-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE DoAndIfThenElse #-}
@@ -12,7 +13,6 @@
 
 module DMCC.Session
   ( Session (..)
-  , ConnectionType (..)
   , startSession
   , stopSession
   , defaultSessionOptions
@@ -43,10 +43,8 @@
                                    , ReadTooShortException
                                    , write
                                    )
-import           System.IO.Streams.Handle
 import qualified System.IO.Streams.SSL as SSLStreams
 
-import           Network
 import qualified Network.HTTP.Client as HTTP
 import           Network.Socket hiding (connect)
 import           OpenSSL
@@ -62,10 +60,6 @@
 import {-# SOURCE #-} DMCC.Agent
 
 
-data ConnectionType = Plain
-                    | TLS { caDir :: Maybe FilePath }
-
-
 -- | Third element is a connection close action.
 type ConnectionData = (InputStream ByteString, OutputStream ByteString, IO ())
 
@@ -132,8 +126,8 @@
 startSession :: (MonadUnliftIO m, MonadLoggerIO m, MonadBaseControl IO m, MonadCatch m)
              => (String, PortNumber)
              -- ^ Host and port of AES server.
-             -> ConnectionType
-             -- ^ Use TLS.
+             -> Maybe FilePath
+             -- ^ AES CA certificates directory for TLS.
              -> Text
              -- ^ DMCC API user.
              -> Text
@@ -142,7 +136,7 @@
              -- ^ Web hook URL.
              -> SessionOptions
              -> m Session
-startSession (host, port) ct user pass whUrl sopts = do
+startSession (host, port) caDir user pass whUrl sopts = do
   syncResponses <- newTVarIO IntMap.empty
   agentRequests <- newTVarIO IntMap.empty
   invoke <- newTVarIO 0
@@ -168,15 +162,7 @@
              else throwIO e
         connect1 attempts =
           handleNetwork (connectExHandler attempts) $
-          liftIO $ case ct of
-            Plain -> do
-              h <- connectTo host (PortNumber $ fromIntegral port)
-              hSetBuffering h NoBuffering
-              is <- handleToInputStream h
-              os <- handleToOutputStream h
-              let cl = hClose h
-              pure (is, os, cl)
-            TLS caDir -> withOpenSSL $ do
+          liftIO $ withOpenSSL $ do
               sslCtx <- SSL.context
               SSL.contextSetDefaultCiphers sslCtx
               SSL.contextSetVerificationMode sslCtx $
