diff --git a/src/io/mod.rs b/src/io/mod.rs
index 12478af6..ab796494 100644
--- a/src/io/mod.rs
+++ b/src/io/mod.rs
@@ -8,7 +8,7 @@ use std::fmt;
 #[cfg(feature = "with-openssl")]
 pub mod openssl;
 #[cfg(feature = "security-framework")]
-mod security_framework;
+pub mod security_framework;
 
 #[cfg(all(feature = "openssl", not(feature = "with-openssl")))]
 const _CHECK: OpensslFeatureRenamedSeeDocs = "";
diff --git a/src/io/openssl.rs b/src/io/openssl.rs
index 521acc57..3bd81f98 100644
--- a/src/io/openssl.rs
+++ b/src/io/openssl.rs
@@ -1,4 +1,4 @@
-//! NegotiateSsl support for OpenSSL.
+//! OpenSSL support.
 extern crate openssl;
 extern crate openssl_verify;
 
diff --git a/src/io/security_framework.rs b/src/io/security_framework.rs
index c2f08fb8..7cfc4f1a 100644
--- a/src/io/security_framework.rs
+++ b/src/io/security_framework.rs
@@ -1,3 +1,4 @@
+//! Security Framework support.
 extern crate security_framework;
 
 use self::security_framework::secure_transport::{SslStream, ClientBuilder};
@@ -14,12 +15,39 @@ impl StreamWrapper for SslStream<Stream> {
     }
 }
 
-impl NegotiateSsl for ClientBuilder {
+/// A `NegotiateSsl` implementation that uses Security Framework.
+#[derive(Debug)]
+pub struct Negotiator(ClientBuilder);
+
+impl Negotiator {
+    /// Returns a new `Negotiator` with default settings.
+    pub fn new() -> Negotiator {
+        ClientBuilder::new().into()
+    }
+
+    /// Returns a reference to the associated `ClientBuilder`.
+    pub fn builder(&self) -> &ClientBuilder {
+        &self.0
+    }
+
+    /// Returns a mutable reference to the associated `ClientBuilder`.
+    pub fn builder_mut(&mut self) -> &mut ClientBuilder {
+        &mut self.0
+    }
+}
+
+impl From<ClientBuilder> for Negotiator {
+    fn from(b: ClientBuilder) -> Negotiator {
+        Negotiator(b)
+    }
+}
+
+impl NegotiateSsl for Negotiator {
     fn negotiate_ssl(&self,
                      domain: &str,
                      stream: Stream)
                      -> Result<Box<StreamWrapper>, Box<Error + Send + Sync>> {
-        let stream = try!(self.handshake(domain, stream));
+        let stream = try!(self.0.handshake(domain, stream));
         Ok(Box::new(stream))
     }
 }
diff --git a/tests/test.rs b/tests/test.rs
index 015ae846..179fdc07 100644
--- a/tests/test.rs
+++ b/tests/test.rs
@@ -24,8 +24,6 @@ use postgres::error::SqlState::{SyntaxError,
 use postgres::error::ErrorPosition::Normal;
 use postgres::rows::RowIndex;
 use postgres::notification::Notification;
-#[cfg(feature = "with-openssl")]
-use postgres::io::openssl::Negotiator;
 
 macro_rules! or_panic {
     ($e:expr) => (
@@ -665,6 +663,8 @@ fn test_cancel_query() {
 #[test]
 #[cfg(feature = "with-openssl")]
 fn test_require_ssl_conn() {
+    use postgres::io::openssl::Negotiator;
+
     let mut negotiator = Negotiator::new().unwrap();
     negotiator.context_mut().set_CA_file(".travis/server.crt").unwrap();
     let conn = or_panic!(Connection::connect("postgres://postgres@localhost",
@@ -675,6 +675,8 @@ fn test_require_ssl_conn() {
 #[test]
 #[cfg(feature = "with-openssl")]
 fn test_prefer_ssl_conn() {
+    use postgres::io::openssl::Negotiator;
+
     let mut negotiator = Negotiator::new().unwrap();
     negotiator.context_mut().set_CA_file(".travis/server.crt").unwrap();
     let conn = or_panic!(Connection::connect("postgres://postgres@localhost",
@@ -685,15 +687,15 @@ fn test_prefer_ssl_conn() {
 #[test]
 #[cfg(feature = "security-framework")]
 fn security_framework_ssl() {
+    use postgres::io::security_framework::Negotiator;
     use security_framework::certificate::SecCertificate;
-    use security_framework::secure_transport::ClientBuilder;
 
     let certificate = include_bytes!("../.travis/server.der");
     let certificate = or_panic!(SecCertificate::from_der(certificate));
-    let mut builder = ClientBuilder::new();
-    builder.anchor_certificates(&[certificate]);
+    let mut negotiator = Negotiator::new();
+    negotiator.builder_mut().anchor_certificates(&[certificate]);
     let conn = or_panic!(Connection::connect("postgres://postgres@localhost",
-                                             SslMode::Require(&builder)));
+                                             SslMode::Require(&negotiator)));
     or_panic!(conn.execute("SELECT 1::VARCHAR", &[]));
 }