diff --git a/registry/service.go b/registry/service.go
index 0cda3a8806..eb9c5c0a29 100644
--- a/registry/service.go
+++ b/registry/service.go
@@ -29,7 +29,6 @@ type Service interface {
 	ResolveRepository(name reference.Named) (*RepositoryInfo, error)
 	Search(ctx context.Context, term string, limit int, authConfig *types.AuthConfig, userAgent string, headers map[string][]string) (*registry.SearchResults, error)
 	ServiceConfig() *registry.ServiceConfig
-	TLSConfig(hostname string) (*tls.Config, error)
 	LoadAllowNondistributableArtifacts([]string) error
 	LoadMirrors([]string) error
 	LoadInsecureRegistries([]string) error
@@ -221,15 +220,6 @@ type APIEndpoint struct {
 	TLSConfig                      *tls.Config
 }
 
-// TLSConfig constructs a client TLS configuration based on server defaults
-func (s *defaultService) TLSConfig(hostname string) (*tls.Config, error) {
-	s.mu.RLock()
-	secure := s.config.isSecureIndex(hostname)
-	s.mu.RUnlock()
-
-	return newTLSConfig(hostname, secure)
-}
-
 // LookupPullEndpoints creates a list of v2 endpoints to try to pull from, in order of preference.
 // It gives preference to mirrors over the actual registry, and HTTPS over plain HTTP.
 func (s *defaultService) LookupPullEndpoints(hostname string) (endpoints []APIEndpoint, err error) {