tls: separate init from enable