diff --git a/src/openvpn/forward.c b/src/openvpn/forward.c
index ddfd5a18..29490a2c 100644
--- a/src/openvpn/forward.c
+++ b/src/openvpn/forward.c
@@ -372,8 +372,11 @@ send_control_channel_string_dowork(struct tls_multi *multi,
     struct gc_arena gc = gc_new();
     bool stat;
 
+    ASSERT(multi);
+    struct key_state *ks = get_key_scan(multi, 0);
+
     /* buffered cleartext write onto TLS control channel */
-    stat = tls_send_payload(multi, (uint8_t *) str, strlen(str) + 1);
+    stat = tls_send_payload(ks, (uint8_t *) str, strlen(str) + 1);
 
     msg(msglevel, "SENT CONTROL [%s]: '%s' (status=%d)",
         tls_common_name(multi, false),
diff --git a/src/openvpn/ssl.c b/src/openvpn/ssl.c
index fe6390fa..60aaee8d 100644
--- a/src/openvpn/ssl.c
+++ b/src/openvpn/ssl.c
@@ -4007,18 +4007,15 @@ tls_post_encrypt(struct tls_multi *multi, struct buffer *buf)
  */
 
 bool
-tls_send_payload(struct tls_multi *multi,
+tls_send_payload(struct key_state *ks,
                  const uint8_t *data,
                  int size)
 {
-    struct key_state *ks;
     bool ret = false;
 
     tls_clear_error();
 
-    ASSERT(multi);
-
-    ks = get_key_scan(multi, 0);
+    ASSERT(ks);
 
     if (ks->state >= S_ACTIVE)
     {
diff --git a/src/openvpn/ssl.h b/src/openvpn/ssl.h
index a050cd5c..4ed4cfaa 100644
--- a/src/openvpn/ssl.h
+++ b/src/openvpn/ssl.h
@@ -424,7 +424,7 @@ void ssl_put_auth_challenge(const char *cr_str);
 /*
  * Send a payload over the TLS control channel
  */
-bool tls_send_payload(struct tls_multi *multi,
+bool tls_send_payload(struct key_state *ks,
                       const uint8_t *data,
                       int size);