diff --git a/src/tls/ext/cert/compression.rs b/src/tls/cert/compression.rs
similarity index 100%
rename from src/tls/ext/cert/compression.rs
rename to src/tls/cert/compression.rs
diff --git a/src/tls/ext/cert/load.rs b/src/tls/cert/load.rs
similarity index 100%
rename from src/tls/ext/cert/load.rs
rename to src/tls/cert/load.rs
diff --git a/src/tls/ext/cert/mod.rs b/src/tls/cert/mod.rs
similarity index 100%
rename from src/tls/ext/cert/mod.rs
rename to src/tls/cert/mod.rs
diff --git a/src/tls/ext/mod.rs b/src/tls/ext.rs
similarity index 98%
rename from src/tls/ext/mod.rs
rename to src/tls/ext.rs
index 4c326dad..10c0f2e0 100644
--- a/src/tls/ext/mod.rs
+++ b/src/tls/ext.rs
@@ -1,10 +1,9 @@
-mod cert;
+use super::cert::{compression::CertCompressionAlgorithm, load, RootCertStore};
 use super::{AlpnProtos, AlpsProtos, TlsResult, TlsVersion};
 use ::std::os::raw::c_int;
 use boring2::error::ErrorStack;
 use boring2::ssl::{ConnectConfiguration, SslConnectorBuilder, SslRef, SslVerifyMode};
 use boring_sys2 as ffi;
-pub use cert::{compression::CertCompressionAlgorithm, load, RootCertStore};
 use foreign_types::ForeignTypeRef;
 
 /// Error handler for the boringssl functions.
diff --git a/src/tls/mod.rs b/src/tls/mod.rs
index 329c6cb0..8fd28bc7 100644
--- a/src/tls/mod.rs
+++ b/src/tls/mod.rs
@@ -5,6 +5,7 @@
 //! - Various parts of TLS can also be configured or even disabled on the
 //!   `ClientBuilder`.
 
+mod cert;
 mod conn;
 mod ext;
 
@@ -18,11 +19,9 @@ use conn::{HttpsLayer, HttpsLayerSettings};
 use std::borrow::Cow;
 use typed_builder::TypedBuilder;
 
+pub use cert::{compression::CertCompressionAlgorithm, RootCertStore};
 pub use conn::{HttpsConnector, MaybeHttpsStream};
-pub use ext::{
-    CertCompressionAlgorithm, ConnectConfigurationExt, RootCertStore, SslConnectorBuilderExt,
-    SslRefExt,
-};
+pub use ext::{ConnectConfigurationExt, SslConnectorBuilderExt, SslRefExt};
 
 type TlsResult<T> = Result<T, ErrorStack>;