diff --git a/plugins/filter_kubernetes/kube_meta.c b/plugins/filter_kubernetes/kube_meta.c
index 399ea64992f..8ae00dce3b9 100644
--- a/plugins/filter_kubernetes/kube_meta.c
+++ b/plugins/filter_kubernetes/kube_meta.c
@@ -1398,9 +1398,9 @@ static int flb_kube_network_init(struct flb_kube *ctx, struct flb_config *config
         if (!ctx->tls_ca_path && !ctx->tls_ca_file) {
             ctx->tls_ca_file  = flb_strdup(FLB_KUBE_CA);
         }
-        ctx->tls = flb_tls_create(ctx->tls_verify,
+        ctx->tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                  ctx->tls_verify,
                                   ctx->tls_debug,
-                                  FLB_TLS_CLIENT_MODE,
                                   ctx->tls_vhost,
                                   ctx->tls_ca_path,
                                   ctx->tls_ca_file,
diff --git a/plugins/filter_nightfall/nightfall.c b/plugins/filter_nightfall/nightfall.c
index 5847fde27b3..fa5002c1846 100644
--- a/plugins/filter_nightfall/nightfall.c
+++ b/plugins/filter_nightfall/nightfall.c
@@ -89,9 +89,9 @@ static int cb_nightfall_init(struct flb_filter_instance *f_ins,
                    "Bearer %s",
                    ctx->nightfall_api_key);
 
-    ctx->tls = flb_tls_create(ctx->tls_verify,
+    ctx->tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                              ctx->tls_verify,
                               ctx->tls_debug,
-                              FLB_TLS_CLIENT_MODE,
                               ctx->tls_vhost,
                               ctx->tls_ca_path,
                               NULL,
diff --git a/plugins/in_tcp/tcp_config.c b/plugins/in_tcp/tcp_config.c
index a4766f9a30c..f4a9da3ec4a 100644
--- a/plugins/in_tcp/tcp_config.c
+++ b/plugins/in_tcp/tcp_config.c
@@ -121,9 +121,9 @@ struct flb_in_tcp_config *tcp_config_init(struct flb_input_instance *ins)
     }
 
     if (ins->use_tls) {
-        ins->tls = flb_tls_create(ins->tls_verify,
+        ins->tls = flb_tls_create(FLB_TLS_SERVER_MODE,
+                                  ins->tls_verify,
                                   ins->tls_debug,
-                                  FLB_TLS_SERVER_MODE,
                                   ins->tls_vhost,
                                   ins->tls_ca_path,
                                   ins->tls_ca_file,
diff --git a/plugins/out_bigquery/bigquery.c b/plugins/out_bigquery/bigquery.c
index 571cd2dc88d..8ff2a613c36 100644
--- a/plugins/out_bigquery/bigquery.c
+++ b/plugins/out_bigquery/bigquery.c
@@ -684,9 +684,9 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
 
     if (ctx->has_identity_federation) {
         /* Configure AWS IMDS */
-        ctx->aws_tls = flb_tls_create(FLB_TRUE,
+        ctx->aws_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                      FLB_TRUE,
                                       ins->tls_debug,
-                                      FLB_TLS_CLIENT_MODE,
                                       ins->tls_vhost,
                                       ins->tls_ca_path,
                                       ins->tls_ca_file,
@@ -722,9 +722,9 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
         ctx->aws_provider->provider_vtable->upstream_set(ctx->aws_provider, ctx->ins);
 
         /* Configure AWS STS */
-        ctx->aws_sts_tls = flb_tls_create(FLB_TRUE,
+        ctx->aws_sts_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                          FLB_TRUE,
                                           ins->tls_debug,
-                                          FLB_TLS_CLIENT_MODE,
                                           ins->tls_vhost,
                                           ins->tls_ca_path,
                                           ins->tls_ca_file,
@@ -753,9 +753,9 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
         ctx->aws_sts_upstream->net.keepalive = FLB_FALSE;
 
         /* Configure Google STS */
-        ctx->google_sts_tls = flb_tls_create(FLB_TRUE,
+        ctx->google_sts_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                             FLB_TRUE,
                                              ins->tls_debug,
-                                             FLB_TLS_CLIENT_MODE,
                                              ins->tls_vhost,
                                              ins->tls_ca_path,
                                              ins->tls_ca_file,
@@ -781,9 +781,9 @@ static int cb_bigquery_init(struct flb_output_instance *ins,
         }
 
         /* Configure Google IAM */
-        ctx->google_iam_tls = flb_tls_create(FLB_TRUE,
+        ctx->google_iam_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                             FLB_TRUE,
                                              ins->tls_debug,
-                                             FLB_TLS_CLIENT_MODE,
                                              ins->tls_vhost,
                                              ins->tls_ca_path,
                                              ins->tls_ca_file,
diff --git a/plugins/out_cloudwatch_logs/cloudwatch_logs.c b/plugins/out_cloudwatch_logs/cloudwatch_logs.c
index a36e26622f2..c0474b89e09 100644
--- a/plugins/out_cloudwatch_logs/cloudwatch_logs.c
+++ b/plugins/out_cloudwatch_logs/cloudwatch_logs.c
@@ -223,9 +223,9 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins,
     }
 
     /* one tls instance for provider, one for cw client */
-    ctx->cred_tls = flb_tls_create(FLB_TRUE,
+    ctx->cred_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                   FLB_TRUE,
                                    ins->tls_debug,
-                                   FLB_TLS_CLIENT_MODE,
                                    ins->tls_vhost,
                                    ins->tls_ca_path,
                                    ins->tls_ca_file,
@@ -238,9 +238,9 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins,
         goto error;
     }
 
-    ctx->client_tls = flb_tls_create(FLB_TRUE,
+    ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                     FLB_TRUE,
                                      ins->tls_debug,
-                                     FLB_TLS_CLIENT_MODE,
                                      ins->tls_vhost,
                                      ins->tls_ca_path,
                                      ins->tls_ca_file,
@@ -273,9 +273,9 @@ static int cb_cloudwatch_init(struct flb_output_instance *ins,
         }
 
         /* STS provider needs yet another separate TLS instance */
-        ctx->sts_tls = flb_tls_create(FLB_TRUE,
+        ctx->sts_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                      FLB_TRUE,
                                       ins->tls_debug,
-                                      FLB_TLS_CLIENT_MODE,
                                       ins->tls_vhost,
                                       ins->tls_ca_path,
                                       ins->tls_ca_file,
diff --git a/plugins/out_es/es_conf.c b/plugins/out_es/es_conf.c
index 7ff30fc9f79..631d13dade2 100644
--- a/plugins/out_es/es_conf.c
+++ b/plugins/out_es/es_conf.c
@@ -312,9 +312,9 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins,
             flb_debug("[out_es] Enabled AWS Auth");
 
             /* AWS provider needs a separate TLS instance */
-            ctx->aws_tls = flb_tls_create(FLB_TRUE,
+            ctx->aws_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                          FLB_TRUE,
                                           ins->tls_debug,
-                                          FLB_TLS_CLIENT_MODE,
                                           ins->tls_vhost,
                                           ins->tls_ca_path,
                                           ins->tls_ca_file,
@@ -372,9 +372,9 @@ struct flb_elasticsearch *flb_es_conf_create(struct flb_output_instance *ins,
                 }
 
                 /* STS provider needs yet another separate TLS instance */
-                ctx->aws_sts_tls = flb_tls_create(FLB_TRUE,
+                ctx->aws_sts_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                                  FLB_TRUE,
                                                   ins->tls_debug,
-                                                  FLB_TLS_CLIENT_MODE,
                                                   ins->tls_vhost,
                                                   ins->tls_ca_path,
                                                   ins->tls_ca_file,
diff --git a/plugins/out_kinesis_firehose/firehose.c b/plugins/out_kinesis_firehose/firehose.c
index d5b4c192db0..0c597442b02 100644
--- a/plugins/out_kinesis_firehose/firehose.c
+++ b/plugins/out_kinesis_firehose/firehose.c
@@ -149,9 +149,9 @@ static int cb_firehose_init(struct flb_output_instance *ins,
     }
 
     /* one tls instance for provider, one for cw client */
-    ctx->cred_tls = flb_tls_create(FLB_TRUE,
+    ctx->cred_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                   FLB_TRUE,
                                    ins->tls_debug,
-                                   FLB_TLS_CLIENT_MODE,
                                    ins->tls_vhost,
                                    ins->tls_ca_path,
                                    ins->tls_ca_file,
@@ -164,9 +164,9 @@ static int cb_firehose_init(struct flb_output_instance *ins,
         goto error;
     }
 
-    ctx->client_tls = flb_tls_create(FLB_TRUE,
+    ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                     FLB_TRUE,
                                      ins->tls_debug,
-                                     FLB_TLS_CLIENT_MODE,
                                      ins->tls_vhost,
                                      ins->tls_ca_path,
                                      ins->tls_ca_file,
@@ -199,9 +199,9 @@ static int cb_firehose_init(struct flb_output_instance *ins,
         }
 
         /* STS provider needs yet another separate TLS instance */
-        ctx->sts_tls = flb_tls_create(FLB_TRUE,
+        ctx->sts_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                      FLB_TRUE,
                                       ins->tls_debug,
-                                      FLB_TLS_CLIENT_MODE,
                                       ins->tls_vhost,
                                       ins->tls_ca_path,
                                       ins->tls_ca_file,
diff --git a/plugins/out_kinesis_streams/kinesis.c b/plugins/out_kinesis_streams/kinesis.c
index 2a0ffbc4096..8aa9145d679 100644
--- a/plugins/out_kinesis_streams/kinesis.c
+++ b/plugins/out_kinesis_streams/kinesis.c
@@ -138,9 +138,9 @@ static int cb_kinesis_init(struct flb_output_instance *ins,
     }
 
     /* one tls instance for provider, one for cw client */
-    ctx->cred_tls = flb_tls_create(FLB_TRUE,
+    ctx->cred_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                   FLB_TRUE,
                                    ins->tls_debug,
-                                   FLB_TLS_CLIENT_MODE,
                                    ins->tls_vhost,
                                    ins->tls_ca_path,
                                    ins->tls_ca_file,
@@ -153,9 +153,9 @@ static int cb_kinesis_init(struct flb_output_instance *ins,
         goto error;
     }
 
-    ctx->client_tls = flb_tls_create(FLB_TRUE,
+    ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                     FLB_TRUE,
                                      ins->tls_debug,
-                                     FLB_TLS_CLIENT_MODE,
                                      ins->tls_vhost,
                                      ins->tls_ca_path,
                                      ins->tls_ca_file,
@@ -195,15 +195,15 @@ static int cb_kinesis_init(struct flb_output_instance *ins,
         }
 
         /* STS provider needs yet another separate TLS instance */
-        ctx->sts_tls = flb_tls_create(FLB_TRUE,
-                                     ins->tls_debug,
-                                     FLB_TLS_CLIENT_MODE,
-                                     ins->tls_vhost,
-                                     ins->tls_ca_path,
-                                     ins->tls_ca_file,
-                                     ins->tls_crt_file,
-                                     ins->tls_key_file,
-                                     ins->tls_key_passwd);
+        ctx->sts_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                      FLB_TRUE,
+                                      ins->tls_debug,
+                                      ins->tls_vhost,
+                                      ins->tls_ca_path,
+                                      ins->tls_ca_file,
+                                      ins->tls_crt_file,
+                                      ins->tls_key_file,
+                                      ins->tls_key_passwd);
         if (!ctx->sts_tls) {
             flb_errno();
             goto error;
diff --git a/plugins/out_opensearch/os_conf.c b/plugins/out_opensearch/os_conf.c
index 6cbbeb78bba..3b510d94d50 100644
--- a/plugins/out_opensearch/os_conf.c
+++ b/plugins/out_opensearch/os_conf.c
@@ -209,9 +209,9 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins,
             flb_debug("[out_es] Enabled AWS Auth");
 
             /* AWS provider needs a separate TLS instance */
-            ctx->aws_tls = flb_tls_create(FLB_TRUE,
+            ctx->aws_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                          FLB_TRUE,
                                           ins->tls_debug,
-                                          FLB_TLS_CLIENT_MODE,
                                           ins->tls_vhost,
                                           ins->tls_ca_path,
                                           ins->tls_ca_file,
@@ -269,9 +269,9 @@ struct flb_opensearch *flb_os_conf_create(struct flb_output_instance *ins,
                 }
 
                 /* STS provider needs yet another separate TLS instance */
-                ctx->aws_sts_tls = flb_tls_create(FLB_TRUE,
+                ctx->aws_sts_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                                  FLB_TRUE,
                                                   ins->tls_debug,
-                                                  FLB_TLS_CLIENT_MODE,
                                                   ins->tls_vhost,
                                                   ins->tls_ca_path,
                                                   ins->tls_ca_file,
diff --git a/plugins/out_s3/s3.c b/plugins/out_s3/s3.c
index d119f3c0498..feffc1681b6 100644
--- a/plugins/out_s3/s3.c
+++ b/plugins/out_s3/s3.c
@@ -770,9 +770,9 @@ static int cb_s3_init(struct flb_output_instance *ins,
     }
 
     if (ctx->insecure == FLB_FALSE) {
-        ctx->client_tls = flb_tls_create(ins->tls_verify,
+        ctx->client_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                         ins->tls_verify,
                                          ins->tls_debug,
-                                         FLB_TLS_CLIENT_MODE,
                                          ins->tls_vhost,
                                          ins->tls_ca_path,
                                          ins->tls_ca_file,
@@ -786,9 +786,9 @@ static int cb_s3_init(struct flb_output_instance *ins,
     }
 
     /* AWS provider needs a separate TLS instance */
-    ctx->provider_tls = flb_tls_create(FLB_TRUE,
+    ctx->provider_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                       FLB_TRUE,
                                        ins->tls_debug,
-                                       FLB_TLS_CLIENT_MODE,
                                        ins->tls_vhost,
                                        ins->tls_ca_path,
                                        ins->tls_ca_file,
@@ -819,9 +819,9 @@ static int cb_s3_init(struct flb_output_instance *ins,
         role_arn = (char *) tmp;
 
         /* STS provider needs yet another separate TLS instance */
-        ctx->sts_provider_tls = flb_tls_create(FLB_TRUE,
+        ctx->sts_provider_tls = flb_tls_create(FLB_TLS_CLIENT_MODE,
+                                               FLB_TRUE,
                                                ins->tls_debug,
-                                               FLB_TLS_CLIENT_MODE,
                                                ins->tls_vhost,
                                                ins->tls_ca_path,
                                                ins->tls_ca_file,