diff --git a/internal/engine/netx/netx.go b/internal/engine/netx/netx.go
index da10f18..74a513d 100644
--- a/internal/engine/netx/netx.go
+++ b/internal/engine/netx/netx.go
@@ -33,12 +33,12 @@ import (
 	"github.com/lucas-clemente/quic-go"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/bytecounter"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/dialer"
-	"github.com/ooni/probe-cli/v3/internal/engine/netx/gocertifi"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/httptransport"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/quicdialer"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/resolver"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/selfcensor"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/tlsdialer"
+	"github.com/ooni/probe-cli/v3/internal/engine/netx/tlsx"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
 	"github.com/ooni/probe-cli/v3/internal/runtimex"
 )
@@ -114,8 +114,8 @@ type tlsHandshaker interface {
 // NewDefaultCertPool returns a copy of the default x509
 // certificate pool. This function panics on failure.
 func NewDefaultCertPool() *x509.CertPool {
-	pool, err := gocertifi.CACerts()
-	runtimex.PanicOnError(err, "gocertifi.CACerts() failed")
+	pool, err := tlsx.CACerts()
+	runtimex.PanicOnError(err, "tlsx.CACerts() failed")
 	return pool
 }
 
diff --git a/internal/engine/netx/gocertifi/certifi.go b/internal/engine/netx/tlsx/certifi.go
similarity index 99%
rename from internal/engine/netx/gocertifi/certifi.go
rename to internal/engine/netx/tlsx/certifi.go
index 0a1f0f9..da5dfc8 100644
--- a/internal/engine/netx/gocertifi/certifi.go
+++ b/internal/engine/netx/tlsx/certifi.go
@@ -2,7 +2,7 @@
 // 2021-05-12 09:14:54.779668278 +0200 CEST m=+6.872930413
 // https://curl.haxx.se/ca/cacert.pem
 
-package gocertifi
+package tlsx
 
 //go:generate go run generate.go "https://curl.haxx.se/ca/cacert.pem"
 
diff --git a/internal/engine/netx/gocertifi/generate.go b/internal/engine/netx/tlsx/generate.go
similarity index 99%
rename from internal/engine/netx/gocertifi/generate.go
rename to internal/engine/netx/tlsx/generate.go
index 927b08b..eb0165d 100644
--- a/internal/engine/netx/gocertifi/generate.go
+++ b/internal/engine/netx/tlsx/generate.go
@@ -26,7 +26,7 @@ var tmpl = template.Must(template.New("").Parse(`// Code generated by go generat
 // {{ .Timestamp }}
 // {{ .URL }}
 
-package gocertifi
+package tlsx
 
 //go:generate go run generate.go "{{ .URL }}"