diff --git a/include/ldap_pvt.h b/include/ldap_pvt.h
index e86b032cb4..00a01ba093 100644
--- a/include/ldap_pvt.h
+++ b/include/ldap_pvt.h
@@ -428,6 +428,7 @@ LDAP_F (void) ldap_pvt_tls_destroy LDAP_P(( void ));
 LDAP_F (int) ldap_pvt_tls_init LDAP_P(( void ));
 LDAP_F (int) ldap_pvt_tls_init_def_ctx LDAP_P(( int is_server ));
 LDAP_F (int) ldap_pvt_tls_accept LDAP_P(( Sockbuf *sb, void *ctx_arg ));
+LDAP_F (int) ldap_pvt_tls_connect LDAP_P(( struct ldap *ld, Sockbuf *sb, const char *host ));
 LDAP_F (int) ldap_pvt_tls_inplace LDAP_P(( Sockbuf *sb ));
 LDAP_F (void *) ldap_pvt_tls_sb_ctx LDAP_P(( Sockbuf *sb ));
 LDAP_F (void) ldap_pvt_tls_ctx_free LDAP_P(( void * ));
diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c
index 4932b31d86..25582099d8 100644
--- a/libraries/libldap/tls2.c
+++ b/libraries/libldap/tls2.c
@@ -421,6 +421,13 @@ ldap_int_tls_connect( LDAP *ld, LDAPConn *conn, const char *host )
 	return 0;
 }
 
+int
+ldap_pvt_tls_connect( LDAP *ld, Sockbuf *sb, const char *host )
+{
+	LDAPConn conn = { .lconn_sb = sb };
+	return ldap_int_tls_connect( ld, &conn, host );
+}
+
 /*
  * Call this to do a TLS accept on a sockbuf.
  * Everything else is the same as with tls_connect.