diff --git a/include/types/ssl_ckch.h b/include/haproxy/ssl_ckch-t.h
similarity index 94%
rename from include/types/ssl_ckch.h
rename to include/haproxy/ssl_ckch-t.h
index a4108104b..d102887af 100644
--- a/include/types/ssl_ckch.h
+++ b/include/haproxy/ssl_ckch-t.h
@@ -1,5 +1,5 @@
 /*
- * include/types/ssl_ckch.h
+ * include/haproxy/ssl_ckch-t.h
  * ckch structures
  *
  * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
@@ -29,10 +29,12 @@
  */
 
 
-#ifndef _TYPES_SSL_CKCH_H
-#define _TYPES_SSL_CKCH_H
+#ifndef _HAPROXY_SSL_CKCH_T_H
+#define _HAPROXY_SSL_CKCH_T_H
 #ifdef USE_OPENSSL
 
+#include <import/ebmbtree.h>
+#include <haproxy/buf-t.h>
 #include <haproxy/list-t.h>
 #include <haproxy/openssl-compat.h>
 
@@ -93,4 +95,4 @@ struct ckch_inst {
 };
 
 #endif /* USE_OPENSSL */
-#endif /* _TYPES_SSL_CKCH_H */
+#endif /* _HAPROXY_SSL_CKCH_T_H */
diff --git a/include/proto/ssl_ckch.h b/include/haproxy/ssl_ckch.h
similarity index 94%
rename from include/proto/ssl_ckch.h
rename to include/haproxy/ssl_ckch.h
index d0df9b9ac..919389d6c 100644
--- a/include/proto/ssl_ckch.h
+++ b/include/haproxy/ssl_ckch.h
@@ -1,5 +1,5 @@
 /*
- * include/proto/ssl_ckch.h
+ * include/haproxy/ssl_ckch.h
  * ckch function prototypes
  *
  * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
@@ -19,10 +19,12 @@
  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-#ifndef _PROTO_SSL_CKCH_H
-#define _PROTO_SSL_CKCH_H
+#ifndef _HAPROXY_SSL_CKCH_H
+#define _HAPROXY_SSL_CKCH_H
 #ifdef USE_OPENSSL
 
+#include <haproxy/ssl_ckch-t.h>
+
 /* cert_key_and_chain functions */
 
 int ssl_sock_load_files_into_ckch(const char *path, struct cert_key_and_chain *ckch, char **err);
@@ -60,4 +62,4 @@ int ckch_inst_new_load_store(const char *path, struct ckch_store *ckchs, struct
                              struct ssl_bind_conf *ssl_conf, char **sni_filter, int fcount, struct ckch_inst **ckchi, char **err);
 
 #endif /* USE_OPENSSL */
-#endif /* _PROTO_SSL_CRTLIST_H */
+#endif /* _HAPROXY_SSL_CRTLIST_H */
diff --git a/include/types/ssl_sock.h b/include/types/ssl_sock.h
index ca41ffc2c..bea2a1603 100644
--- a/include/types/ssl_sock.h
+++ b/include/types/ssl_sock.h
@@ -28,13 +28,13 @@
 #include <import/eb64tree.h>
 
 #include <types/connection.h> /* struct wait_event */
-#include <types/ssl_ckch.h>
 #include <types/ssl_crtlist.h>
 
 #include <haproxy/buf-t.h>
 #include <haproxy/thread.h>
 #include <haproxy/list-t.h>
 #include <haproxy/openssl-compat.h>
+#include <haproxy/ssl_ckch-t.h>
 
 /* ***** READ THIS before adding code here! *****
  *
diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 1fc0d18d1..5b1b4e10e 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -23,18 +23,17 @@
 
 #include <haproxy/base64.h>
 #include <haproxy/errors.h>
+#include <haproxy/ssl_ckch.h>
 #include <haproxy/ssl_utils.h>
 #include <haproxy/tools.h>
 
 #include <import/ebsttree.h>
 
 #include <types/cli.h>
-#include <types/ssl_ckch.h>
 #include <types/ssl_sock.h>
 
 #include <proto/cli.h>
 #include <proto/channel.h>
-#include <proto/ssl_ckch.h>
 #include <proto/ssl_sock.h>
 #include <proto/stream_interface.h>
 
diff --git a/src/ssl_crtlist.c b/src/ssl_crtlist.c
index e7c394cc5..d8362259a 100644
--- a/src/ssl_crtlist.c
+++ b/src/ssl_crtlist.c
@@ -16,6 +16,7 @@
 #include <sys/types.h>
 
 #include <haproxy/errors.h>
+#include <haproxy/ssl_ckch.h>
 #include <haproxy/tools.h>
 
 #include <dirent.h>
@@ -24,14 +25,12 @@
 
 #include <types/cli.h>
 #include <types/ssl_crtlist.h>
-#include <types/ssl_ckch.h>
 #include <types/ssl_sock.h>
 
 #include <proto/channel.h>
 #include <proto/cli.h>
 #include <proto/stream_interface.h>
 #include <proto/ssl_crtlist.h>
-#include <proto/ssl_ckch.h>
 #include <proto/ssl_sock.h>
 
 /* release ssl bind conf */
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 4f57f75bf..86eede351 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -51,6 +51,7 @@
 #include <haproxy/http_rules.h>
 #include <haproxy/openssl-compat.h>
 #include <haproxy/shctx.h>
+#include <haproxy/ssl_ckch.h>
 #include <haproxy/ssl_utils.h>
 #include <haproxy/tools.h>
 #include <haproxy/ticks.h>
@@ -81,7 +82,6 @@
 #include <proto/stream_interface.h>
 #include <proto/log.h>
 #include <proto/proxy.h>
-#include <proto/ssl_ckch.h>
 #include <proto/ssl_crtlist.h>
 #include <proto/ssl_sock.h>
 #include <proto/stream.h>