tls: backport of 60f777d3