The TCL socket command and its server accept callback happen independent of the TLS negotiation. This needs to occur before we can establish the TLS connection since only the accept callback knows what the new channel handle is for use by tls::import. So the best method is to have the socket accept callback call tls::import on the new channel, then do a tls::handshake on it to ensure it is set up.