diff --git a/gnutls.c b/gnutls.c
index b8f0ad29..a12cf6e3 100644
--- a/gnutls.c
+++ b/gnutls.c
@@ -184,42 +184,6 @@ int openconnect_SSL_gets(struct openconnect_info *vpninfo, char *buf, size_t len
 	return i ?: ret;
 }
 
-static int request_passphrase(struct openconnect_info *vpninfo,
-			      char **response, const char *fmt, ...)
-{
-	struct oc_auth_form f;
-	struct oc_form_opt o;
-	char buf[1024];
-	va_list args;
-	int ret;
-
-	if (!vpninfo->process_auth_form)
-		return -EINVAL;
-
-	buf[1023] = 0;
-	memset(&f, 0, sizeof(f));
-	va_start(args, fmt);
-	vsnprintf(buf, 1023, fmt, args);
-	va_end(args);
-
-	f.auth_id = (char *)"ssl_certificate";
-	f.opts = &o;
-
-	o.next = NULL;
-	o.type = OC_FORM_OPT_PASSWORD;
-	o.name = (char *)"passphrase";
-	o.label = buf;
-	o.value = NULL;
-
-	ret = vpninfo->process_auth_form(vpninfo, &f);
-	if (!ret) {
-		*response = o.value;
-		return 0;
-	}
-
-	return -EIO;
-}
-
 static int check_certificate_expiry(struct openconnect_info *vpninfo, gnutls_x509_crt_t cert)
 {
 	const char *reason = NULL;
diff --git a/openconnect-internal.h b/openconnect-internal.h
index 0b206629..2245e4ad 100644
--- a/openconnect-internal.h
+++ b/openconnect-internal.h
@@ -299,10 +299,12 @@ int cstp_reconnect(struct openconnect_info *vpninfo);
 
 /* ssl.c */
 int connect_https_socket(struct openconnect_info *vpninfo);
-
-/* ${SSL_LIBRARY}.c */
+int request_passphrase(struct openconnect_info *vpninfo,
+		       char **response, const char *fmt, ...);
 int  __attribute__ ((format (printf, 2, 3)))
     openconnect_SSL_printf(struct openconnect_info *vpninfo, const char *fmt, ...);
+
+/* ${SSL_LIBRARY}.c */
 int openconnect_SSL_gets(struct openconnect_info *vpninfo, char *buf, size_t len);
 int openconnect_SSL_write(struct openconnect_info *vpninfo, char *buf, size_t len);
 int openconnect_SSL_read(struct openconnect_info *vpninfo, char *buf, size_t len);
diff --git a/ssl.c b/ssl.c
index 811a7fac..cfc3088c 100644
--- a/ssl.c
+++ b/ssl.c
@@ -282,6 +282,42 @@ int  __attribute__ ((format (printf, 2, 3)))
 
 }
 
+int request_passphrase(struct openconnect_info *vpninfo,
+		       char **response, const char *fmt, ...)
+{
+	struct oc_auth_form f;
+	struct oc_form_opt o;
+	char buf[1024];
+	va_list args;
+	int ret;
+
+	if (!vpninfo->process_auth_form)
+		return -EINVAL;
+
+	buf[1023] = 0;
+	memset(&f, 0, sizeof(f));
+	va_start(args, fmt);
+	vsnprintf(buf, 1023, fmt, args);
+	va_end(args);
+
+	f.auth_id = (char *)"ssl_certificate";
+	f.opts = &o;
+
+	o.next = NULL;
+	o.type = OC_FORM_OPT_PASSWORD;
+	o.name = (char *)"passphrase";
+	o.label = buf;
+	o.value = NULL;
+
+	ret = vpninfo->process_auth_form(vpninfo, &f);
+	if (!ret) {
+		*response = o.value;
+		return 0;
+	}
+
+	return -EIO;
+}
+
 #if defined(__sun__) || defined(__NetBSD__) || defined(__DragonFly__)
 int openconnect_passphrase_from_fsid(struct openconnect_info *vpninfo)
 {