diff --git a/sources/CMakeLists.txt b/sources/CMakeLists.txt
index 8c36ff2f..400e6362 100644
--- a/sources/CMakeLists.txt
+++ b/sources/CMakeLists.txt
@@ -21,8 +21,9 @@ set(machine_src thread.c
                 channel.c
                 queue.c
                 task_mgr.c
-                tls_api.c
+                tls.c
                 tls_io.c
+                tls_api.c
                 io.c
                 close.c
                 connect.c
diff --git a/sources/machinarium_private.h b/sources/machinarium_private.h
index a4a725ac..133e2548 100644
--- a/sources/machinarium_private.h
+++ b/sources/machinarium_private.h
@@ -74,8 +74,10 @@
 #include "machine_mgr.h"
 #include "mm.h"
 
+#include "tls.h"
 #include "tls_api.h"
 #include "tls_io.h"
+
 #include "io.h"
 #include "read.h"
 #include "write.h"
diff --git a/sources/read.c b/sources/read.c
index 88806f53..5107b901 100644
--- a/sources/read.c
+++ b/sources/read.c
@@ -183,7 +183,7 @@ MACHINE_API int
 machine_read(machine_io_t *obj, char *buf, int size, uint32_t time_ms)
 {
 	mm_io_t *io = mm_cast(mm_io_t*, obj);
-	if (mm_tls_is_active(&io->tls))
+	if (mm_tlsio_is_active(&io->tls))
 		return mm_tlsio_read(&io->tls, buf, size, time_ms);
 	return mm_read(io, buf, size, time_ms);
 }
diff --git a/sources/tls.c b/sources/tls.c
new file mode 100644
index 00000000..da69a577
--- /dev/null
+++ b/sources/tls.c
@@ -0,0 +1,64 @@
+
+/*
+ * machinarium.
+ *
+ * cooperative multitasking engine.
+*/
+
+#include <machinarium.h>
+#include <machinarium_private.h>
+
+static pthread_mutex_t *mm_tls_locks;
+
+static void
+mm_tls_thread_id(CRYPTO_THREADID *tid)
+{
+	CRYPTO_THREADID_set_numeric(tid, (unsigned long)pthread_self());
+}
+
+static void
+mm_tls_locking_callback(int mode, int type, const char *file, int line)
+{
+	(void)file;
+	(void)line;
+	if (mode & CRYPTO_LOCK)
+		pthread_mutex_lock(&mm_tls_locks[type]);
+	else
+		pthread_mutex_unlock(&mm_tls_locks[type]);
+}
+
+void mm_tls_init(void)
+{
+	SSL_library_init();
+	SSL_load_error_strings();
+	int size = CRYPTO_num_locks() * sizeof(pthread_mutex_t);
+	mm_tls_locks = OPENSSL_malloc(size);
+	if (mm_tls_locks == NULL) {
+		abort();
+		return;
+	}
+	int i = 0;
+	for (; i < CRYPTO_num_locks(); i++)
+		pthread_mutex_init(&mm_tls_locks[i], NULL);
+	CRYPTO_THREADID_set_callback(mm_tls_thread_id);
+	CRYPTO_set_locking_callback(mm_tls_locking_callback);
+}
+
+void mm_tls_free(void)
+{
+	CRYPTO_set_locking_callback(NULL);
+	int i = 0;
+	for (; i < CRYPTO_num_locks(); i++)
+		pthread_mutex_destroy(&mm_tls_locks[i]);
+	OPENSSL_free(mm_tls_locks);
+#if 0
+	SSL_COMP_free_compression_methods();
+#endif
+	FIPS_mode_set(0);
+	ENGINE_cleanup();
+	CONF_modules_unload(1);
+	EVP_cleanup();
+	CRYPTO_cleanup_all_ex_data();
+	ERR_remove_state(getpid());
+	ERR_free_strings();
+}
diff --git a/sources/tls.h b/sources/tls.h
new file mode 100644
index 00000000..3fb2def0
--- /dev/null
+++ b/sources/tls.h
@@ -0,0 +1,13 @@
+#ifndef MM_TLS_H
+#define MM_TLS_H
+
+/*
+ * machinarium.
+ *
+ * cooperative multitasking engine.
+*/
+
+void mm_tls_init(void);
+void mm_tls_free(void);
+
+#endif /* MM_TLS_H */
diff --git a/sources/tls_io.c b/sources/tls_io.c
index 64efcf8f..d4dc7cc9 100644
--- a/sources/tls_io.c
+++ b/sources/tls_io.c
@@ -8,61 +8,6 @@
 #include <machinarium.h>
 #include <machinarium_private.h>
 
-static pthread_mutex_t *mm_tls_locks;
-
-static void
-mm_tls_thread_id(CRYPTO_THREADID *tid)
-{
-	CRYPTO_THREADID_set_numeric(tid, (unsigned long)pthread_self());
-}
-
-static void
-mm_tls_locking_callback(int mode, int type, const char *file, int line)
-{
-	(void)file;
-	(void)line;
-	if (mode & CRYPTO_LOCK)
-		pthread_mutex_lock(&mm_tls_locks[type]);
-	else
-		pthread_mutex_unlock(&mm_tls_locks[type]);
-}
-
-void mm_tls_init(void)
-{
-	SSL_library_init();
-	SSL_load_error_strings();
-	int size = CRYPTO_num_locks() * sizeof(pthread_mutex_t);
-	mm_tls_locks = OPENSSL_malloc(size);
-	if (mm_tls_locks == NULL) {
-		abort();
-		return;
-	}
-	int i = 0;
-	for (; i < CRYPTO_num_locks(); i++)
-		pthread_mutex_init(&mm_tls_locks[i], NULL);
-	CRYPTO_THREADID_set_callback(mm_tls_thread_id);
-	CRYPTO_set_locking_callback(mm_tls_locking_callback);
-}
-
-void mm_tls_free(void)
-{
-	CRYPTO_set_locking_callback(NULL);
-	int i = 0;
-	for (; i < CRYPTO_num_locks(); i++)
-		pthread_mutex_destroy(&mm_tls_locks[i]);
-	OPENSSL_free(mm_tls_locks);
-#if 0
-	SSL_COMP_free_compression_methods();
-#endif
-	FIPS_mode_set(0);
-	ENGINE_cleanup();
-	CONF_modules_unload(1);
-	EVP_cleanup();
-	CRYPTO_cleanup_all_ex_data();
-	ERR_remove_state(getpid());
-	ERR_free_strings();
-}
-
 void mm_tlsio_init(mm_tlsio_t *io, void *io_arg)
 {
 	memset(io, 0, sizeof(*io));
diff --git a/sources/tls_io.h b/sources/tls_io.h
index 1aa106d9..a1692615 100644
--- a/sources/tls_io.h
+++ b/sources/tls_io.h
@@ -21,12 +21,10 @@ struct mm_tlsio
 };
 
 static inline int
-mm_tls_is_active(mm_tlsio_t *io) {
+mm_tlsio_is_active(mm_tlsio_t *io) {
 	return io->ssl != NULL;
 }
 
-void mm_tls_init(void);
-void mm_tls_free(void);
 void mm_tlsio_init(mm_tlsio_t*, void*);
 void mm_tlsio_free(mm_tlsio_t*);
 void mm_tlsio_error_reset(mm_tlsio_t*);
diff --git a/sources/write.c b/sources/write.c
index 457ae60c..cf834603 100644
--- a/sources/write.c
+++ b/sources/write.c
@@ -110,7 +110,7 @@ MACHINE_API int
 machine_write(machine_io_t *obj, char *buf, int size, uint32_t time_ms)
 {
 	mm_io_t *io = mm_cast(mm_io_t*, obj);
-	if (mm_tls_is_active(&io->tls))
+	if (mm_tlsio_is_active(&io->tls))
 		return mm_tlsio_write(&io->tls, buf, size, time_ms);
 	return mm_write(io, buf, size, time_ms);
 }