diff --git a/client/hijack.go b/client/hijack.go
index 9376d21b97..e3f63e20c2 100644
--- a/client/hijack.go
+++ b/client/hijack.go
@@ -11,7 +11,7 @@ import (
 	"time"
 
 	"github.com/docker/docker/api/types"
-	"github.com/docker/docker/client/transport"
+	"github.com/docker/docker/pkg/tlsconfig"
 	"github.com/docker/go-connections/sockets"
 	"golang.org/x/net/context"
 )
@@ -136,7 +136,7 @@ func tlsDialWithDialer(dialer *net.Dialer, network, addr string, config *tls.Con
 	// from the hostname we're connecting to.
 	if config.ServerName == "" {
 		// Make a copy to avoid polluting argument or default.
-		config = transport.TLSConfigClone(config)
+		config = tlsconfig.Clone(config)
 		config.ServerName = hostname
 	}
 
diff --git a/client/transport/tlsconfig_clone.go b/client/transport/tlsconfig_clone.go
deleted file mode 100644
index 034bc01d33..0000000000
--- a/client/transport/tlsconfig_clone.go
+++ /dev/null
@@ -1,11 +0,0 @@
-// +build go1.8
-
-package transport
-
-import "crypto/tls"
-
-// TLSConfigClone returns a clone of tls.Config. This function is provided for
-// compatibility for go1.7 that doesn't include this method in stdlib.
-func TLSConfigClone(c *tls.Config) *tls.Config {
-	return c.Clone()
-}
diff --git a/pkg/tlsconfig/tlsconfig_clone.go b/pkg/tlsconfig/tlsconfig_clone.go
new file mode 100644
index 0000000000..e4dec3a5d1
--- /dev/null
+++ b/pkg/tlsconfig/tlsconfig_clone.go
@@ -0,0 +1,11 @@
+// +build go1.8
+
+package tlsconfig
+
+import "crypto/tls"
+
+// Clone returns a clone of tls.Config. This function is provided for
+// compatibility for go1.7 that doesn't include this method in stdlib.
+func Clone(c *tls.Config) *tls.Config {
+	return c.Clone()
+}
diff --git a/client/transport/tlsconfig_clone_go16.go b/pkg/tlsconfig/tlsconfig_clone_go16.go
similarity index 87%
rename from client/transport/tlsconfig_clone_go16.go
rename to pkg/tlsconfig/tlsconfig_clone_go16.go
index 12f13e4694..0b816650ec 100644
--- a/client/transport/tlsconfig_clone_go16.go
+++ b/pkg/tlsconfig/tlsconfig_clone_go16.go
@@ -1,12 +1,12 @@
 // +build go1.6,!go1.7
 
-package transport
+package tlsconfig
 
 import "crypto/tls"
 
-// TLSConfigClone returns a clone of tls.Config. This function is provided for
+// Clone returns a clone of tls.Config. This function is provided for
 // compatibility for go1.6 that doesn't include this method in stdlib.
-func TLSConfigClone(c *tls.Config) *tls.Config {
+func Clone(c *tls.Config) *tls.Config {
 	return &tls.Config{
 		Rand:                     c.Rand,
 		Time:                     c.Time,
diff --git a/client/transport/tlsconfig_clone_go17.go b/pkg/tlsconfig/tlsconfig_clone_go17.go
similarity index 88%
rename from client/transport/tlsconfig_clone_go17.go
rename to pkg/tlsconfig/tlsconfig_clone_go17.go
index 50bf389e43..0d5b448fec 100644
--- a/client/transport/tlsconfig_clone_go17.go
+++ b/pkg/tlsconfig/tlsconfig_clone_go17.go
@@ -1,12 +1,12 @@
 // +build go1.7,!go1.8
 
-package transport
+package tlsconfig
 
 import "crypto/tls"
 
-// TLSConfigClone returns a clone of tls.Config. This function is provided for
+// Clone returns a clone of tls.Config. This function is provided for
 // compatibility for go1.7 that doesn't include this method in stdlib.
-func TLSConfigClone(c *tls.Config) *tls.Config {
+func Clone(c *tls.Config) *tls.Config {
 	return &tls.Config{
 		Rand:                        c.Rand,
 		Time:                        c.Time,