tls: create an internal header