diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c
index a72d4dc0c..3dd13acdb 100644
--- a/programs/ssl/ssl_client2.c
+++ b/programs/ssl/ssl_client2.c
@@ -521,8 +521,6 @@ struct options
     const char *mki;            /* The dtls mki value to use                */
 } opt;
 
-int query_config( const char *config );
-
 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
 typedef struct eap_tls_keys
 {
diff --git a/programs/ssl/ssl_server2.c b/programs/ssl/ssl_server2.c
index c404f2eb3..25d5289d3 100644
--- a/programs/ssl/ssl_server2.c
+++ b/programs/ssl/ssl_server2.c
@@ -624,8 +624,6 @@ struct options
     int support_mki;            /* The dtls mki mki support                 */
 } opt;
 
-int query_config( const char *config );
-
 #if defined(MBEDTLS_SSL_EXPORT_KEYS)
 typedef struct eap_tls_keys
 {
diff --git a/programs/ssl/ssl_test_lib.h b/programs/ssl/ssl_test_lib.h
index 83f7858df..dc8edce3e 100644
--- a/programs/ssl/ssl_test_lib.h
+++ b/programs/ssl/ssl_test_lib.h
@@ -83,6 +83,19 @@
 
 #include <test/helpers.h>
 
+/** Check whether a given configuration symbol is enabled.
+ *
+ * \param config    The symbol to query (e.g. "MBEDTLS_RSA_C").
+ * \return          \c 0 if the symbol was defined at compile time
+ *                  (in MBEDTLS_CONFIG_FILE or config.h),
+ *                  \c 1 otherwise.
+ *
+ * \note            This function is defined in `programs/test/query_config.c`
+ *                  which is automatically generated by
+ *                  `scripts/generate_query_config.pl`.
+ */
+int query_config( const char *config );
+
 #endif /* MBEDTLS_SSL_TEST_IMPOSSIBLE conditions: else */
 
 #endif /* MBEDTLS_PROGRAMS_SSL_SSL_TEST_LIB_H */