diff --git a/internal/netxlite/legacy.go b/internal/netxlite/legacy.go
index ba4b941..8df12be 100644
--- a/internal/netxlite/legacy.go
+++ b/internal/netxlite/legacy.go
@@ -44,6 +44,7 @@ func reduceErrors(errorslist []error) error {
 var (
 	DefaultDialer        = defaultDialer
 	DefaultTLSHandshaker = defaultTLSHandshaker
+	NewConnUTLS          = newConnUTLS
 )
 
 // These types export internal names to legacy ooni/probe-cli code.
diff --git a/internal/netxlite/tls.go b/internal/netxlite/tls.go
index b1af11c..5136503 100644
--- a/internal/netxlite/tls.go
+++ b/internal/netxlite/tls.go
@@ -124,6 +124,15 @@ type TLSHandshaker interface {
 		net.Conn, tls.ConnectionState, error)
 }
 
+// NewTLSHandshakerStdlib creates a new TLS handshaker using the
+// go standard library to create TLS connections.
+func NewTLSHandshakerStdlib(logger Logger) TLSHandshaker {
+	return &tlsHandshakerLogger{
+		TLSHandshaker: &tlsHandshakerConfigurable{},
+		Logger:        logger,
+	}
+}
+
 // tlsHandshakerConfigurable is a configurable TLS handshaker that
 // uses by default the standard library's TLS implementation.
 type tlsHandshakerConfigurable struct {
diff --git a/internal/netxlite/tls_test.go b/internal/netxlite/tls_test.go
index c9b39a3..0ba5c59 100644
--- a/internal/netxlite/tls_test.go
+++ b/internal/netxlite/tls_test.go
@@ -407,3 +407,21 @@ func TestTLSDialerConfigWithALPN(t *testing.T) {
 		t.Fatal(diff)
 	}
 }
+
+func TestNewTLSHandshakerStdlibTypes(t *testing.T) {
+	th := NewTLSHandshakerStdlib(log.Log)
+	thl, okay := th.(*tlsHandshakerLogger)
+	if !okay {
+		t.Fatal("invalid type")
+	}
+	if thl.Logger != log.Log {
+		t.Fatal("invalid logger")
+	}
+	thc, okay := thl.TLSHandshaker.(*tlsHandshakerConfigurable)
+	if !okay {
+		t.Fatal("invalid type")
+	}
+	if thc.NewConn != nil {
+		t.Fatal("expected nil NewConn")
+	}
+}
diff --git a/internal/netxlite/utls.go b/internal/netxlite/utls.go
index 6666c95..6b1070c 100644
--- a/internal/netxlite/utls.go
+++ b/internal/netxlite/utls.go
@@ -7,13 +7,24 @@ import (
 	utls "gitlab.com/yawning/utls.git"
 )
 
+// NewTLSHandshakerUTLS creates a new TLS handshaker using the
+// gitlab.com/yawning/utls library to create TLS conns.
+func NewTLSHandshakerUTLS(logger Logger, id *utls.ClientHelloID) TLSHandshaker {
+	return &tlsHandshakerLogger{
+		TLSHandshaker: &tlsHandshakerConfigurable{
+			NewConn: newConnUTLS(id),
+		},
+		Logger: logger,
+	}
+}
+
 // utlsConn implements TLSConn and uses a utls UConn as its underlying connection
 type utlsConn struct {
 	*utls.UConn
 }
 
-// NewConnUTLS creates a NewConn function creating a utls connection with a specified ClientHelloID
-func NewConnUTLS(clientHello *utls.ClientHelloID) func(conn net.Conn, config *tls.Config) TLSConn {
+// newConnUTLS creates a NewConn function creating a utls connection with a specified ClientHelloID
+func newConnUTLS(clientHello *utls.ClientHelloID) func(conn net.Conn, config *tls.Config) TLSConn {
 	return func(conn net.Conn, config *tls.Config) TLSConn {
 		uConfig := &utls.Config{
 			RootCAs:                     config.RootCAs,
diff --git a/internal/netxlite/utls_test.go b/internal/netxlite/utls_test.go
index 8c8e230..3fe01ce 100644
--- a/internal/netxlite/utls_test.go
+++ b/internal/netxlite/utls_test.go
@@ -6,12 +6,13 @@ import (
 	"net"
 	"testing"
 
+	"github.com/apex/log"
 	utls "gitlab.com/yawning/utls.git"
 )
 
 func TestUTLSHandshakerChrome(t *testing.T) {
 	h := &tlsHandshakerConfigurable{
-		NewConn: NewConnUTLS(&utls.HelloChrome_Auto),
+		NewConn: newConnUTLS(&utls.HelloChrome_Auto),
 	}
 	cfg := &tls.Config{ServerName: "google.com"}
 	conn, err := net.Dial("tcp", "google.com:443")
@@ -26,3 +27,21 @@ func TestUTLSHandshakerChrome(t *testing.T) {
 		t.Fatal("nil connection")
 	}
 }
+
+func TestNewTLSHandshakerUTLSTypes(t *testing.T) {
+	th := NewTLSHandshakerUTLS(log.Log, &utls.HelloChrome_83)
+	thl, okay := th.(*tlsHandshakerLogger)
+	if !okay {
+		t.Fatal("invalid type")
+	}
+	if thl.Logger != log.Log {
+		t.Fatal("invalid logger")
+	}
+	thc, okay := thl.TLSHandshaker.(*tlsHandshakerConfigurable)
+	if !okay {
+		t.Fatal("invalid type")
+	}
+	if thc.NewConn == nil {
+		t.Fatal("expected non-nil NewConn")
+	}
+}