diff --git a/auth/credentials/credentials_ntlm.c b/auth/credentials/credentials_ntlm.c
index f437ee50879..bf55ab97b04 100644
--- a/auth/credentials/credentials_ntlm.c
+++ b/auth/credentials/credentials_ntlm.c
@@ -28,7 +28,7 @@
 #include "auth/credentials/credentials.h"
 #include "auth/credentials/credentials_internal.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/auth/credentials/wscript_build b/auth/credentials/wscript_build
index 637b6ccf268..f5aba1de248 100644
--- a/auth/credentials/wscript_build
+++ b/auth/credentials/wscript_build
@@ -22,7 +22,7 @@ bld.SAMBA_SUBSYSTEM('CREDENTIALS_SECRETS',
 
 bld.SAMBA_SUBSYSTEM('CREDENTIALS_NTLM',
 	source='credentials_ntlm.c',
-	deps='samba-credentials')
+	deps='samba-credentials GNUTLS_HELPERS')
 
 pytalloc_util = bld.pyembed_libname('pytalloc-util')
 pyparam_util = bld.pyembed_libname('pyparam_util')
diff --git a/auth/gensec/schannel.c b/auth/gensec/schannel.c
index d0febc7dc9c..ef62d978122 100644
--- a/auth/gensec/schannel.c
+++ b/auth/gensec/schannel.c
@@ -36,7 +36,7 @@
 #include "lib/crypto/crypto.h"
 #include "libds/common/roles.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/auth/gensec/wscript_build b/auth/gensec/wscript_build
index 8f6dedc1909..1d8071d7c0f 100644
--- a/auth/gensec/wscript_build
+++ b/auth/gensec/wscript_build
@@ -19,7 +19,7 @@ bld.SAMBA_MODULE('gensec_schannel',
 	source='schannel.c',
 	subsystem='gensec',
 	init_function='gensec_schannel_init',
-	deps='COMMON_SCHANNEL NDR_SCHANNEL samba-credentials auth_session'
+	deps='COMMON_SCHANNEL NDR_SCHANNEL samba-credentials auth_session GNUTLS_HELPERS'
 	)
 
 bld.SAMBA_MODULE('gensec_ncalrpc',
diff --git a/auth/ntlmssp/ntlmssp_client.c b/auth/ntlmssp/ntlmssp_client.c
index 8940522d39c..df891f8d933 100644
--- a/auth/ntlmssp/ntlmssp_client.c
+++ b/auth/ntlmssp/ntlmssp_client.c
@@ -35,7 +35,7 @@ struct auth_session_info;
 #include "../auth/ntlmssp/ntlmssp_ndr.h"
 #include "../nsswitch/libwbclient/wbclient.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/auth/ntlmssp/ntlmssp_server.c b/auth/ntlmssp/ntlmssp_server.c
index 6d090b023f8..8fa7baa04d7 100644
--- a/auth/ntlmssp/ntlmssp_server.c
+++ b/auth/ntlmssp/ntlmssp_server.c
@@ -36,7 +36,7 @@
 #include "param/loadparm.h"
 #include "libcli/security/session.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/auth/ntlmssp/ntlmssp_sign.c b/auth/ntlmssp/ntlmssp_sign.c
index 1c4b11174cb..8ba2e246b34 100644
--- a/auth/ntlmssp/ntlmssp_sign.c
+++ b/auth/ntlmssp/ntlmssp_sign.c
@@ -24,7 +24,7 @@
 #include "zlib.h"
 #include "../auth/ntlmssp/ntlmssp_private.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/auth/ntlmssp/wscript_build b/auth/ntlmssp/wscript_build
index 0802330ec6a..20836efad0a 100644
--- a/auth/ntlmssp/wscript_build
+++ b/auth/ntlmssp/wscript_build
@@ -15,6 +15,7 @@ bld.SAMBA_SUBSYSTEM('NTLMSSP_COMMON',
 			 samba-credentials
 			 wbclient
 			 z
+			 GNUTLS_HELPERS
 			 ''')
 
 bld.SAMBA_MODULE('gensec_ntlmssp',
diff --git a/libcli/util/gnutls_error.c b/lib/crypto/gnutls_error.c
similarity index 98%
rename from libcli/util/gnutls_error.c
rename to lib/crypto/gnutls_error.c
index 306977cd771..9e124c20c68 100644
--- a/libcli/util/gnutls_error.c
+++ b/lib/crypto/gnutls_error.c
@@ -16,7 +16,7 @@
  */
 
 #include "includes.h"
-#include "gnutls_error.h"
+#include "gnutls_helpers.h"
 
 #include <gnutls/gnutls.h>
 
diff --git a/libcli/util/gnutls_error.h b/lib/crypto/gnutls_helpers.h
similarity index 92%
rename from libcli/util/gnutls_error.h
rename to lib/crypto/gnutls_helpers.h
index fa6420cea30..3e7300ea2c0 100644
--- a/libcli/util/gnutls_error.h
+++ b/lib/crypto/gnutls_helpers.h
@@ -15,8 +15,8 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
-#ifndef _GNUTLS_ERROR_H
-#define _GNUTLS_ERROR_H
+#ifndef _GNUTLS_HELPERS_H
+#define _GNUTLS_HELPERS_H
 
 #include "ntstatus.h"
 
@@ -28,4 +28,4 @@ NTSTATUS _gnutls_error_to_ntstatus(int gnutls_rc,
 	_gnutls_error_to_ntstatus(gnutls_rc, blocked_status, \
 				  __FUNCTION__, __location__)
 
-#endif /* _GNUTLS_ERROR_H */
+#endif /* _GNUTLS_HELPERS_H */
diff --git a/lib/crypto/wscript_build b/lib/crypto/wscript_build
index 01b70f14f77..e482bbfd487 100644
--- a/lib/crypto/wscript_build
+++ b/lib/crypto/wscript_build
@@ -5,6 +5,10 @@ extra_deps = ''
 if bld.CONFIG_SET("HAVE_AESNI_INTEL"):
         extra_deps += ' aesni-intel'
 
+bld.SAMBA_SUBSYSTEM('GNUTLS_HELPERS',
+                    source='gnutls_error.c',
+                    deps='gnutls samba-errors');
+
 bld.SAMBA_SUBSYSTEM('LIBCRYPTO',
         source='''md4.c arcfour.c
         aes.c rijndael-alg-fst.c aes_cmac_128.c aes_ccm_128.c aes_gcm_128.c
diff --git a/libcli/auth/credentials.c b/libcli/auth/credentials.c
index 1252d0539cd..0b1d84b9799 100644
--- a/libcli/auth/credentials.c
+++ b/libcli/auth/credentials.c
@@ -26,7 +26,7 @@
 #include "libcli/auth/libcli_auth.h"
 #include "../libcli/security/dom_sid.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/libcli/auth/wscript_build b/libcli/auth/wscript_build
index 96dcf981a3e..39489c20b4e 100644
--- a/libcli/auth/wscript_build
+++ b/libcli/auth/wscript_build
@@ -18,7 +18,7 @@ bld.SAMBA_SUBSYSTEM('NTLM_CHECK',
 
 bld.SAMBA_SUBSYSTEM('LIBCLI_AUTH',
 	source='credentials.c session.c smbencrypt.c smbdes.c',
-	public_deps='MSRPC_PARSE gnutls',
+	public_deps='MSRPC_PARSE gnutls GNUTLS_HELPERS',
 	public_headers='credentials.h:domain_credentials.h'
 	)
 
diff --git a/libcli/smb/smb2_signing.c b/libcli/smb/smb2_signing.c
index cfe89b6ef79..2f9bae4ba8e 100644
--- a/libcli/smb/smb2_signing.c
+++ b/libcli/smb/smb2_signing.c
@@ -24,7 +24,7 @@
 #include "../lib/crypto/crypto.h"
 #include "lib/util/iov_buf.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/libcli/smb/smbXcli_base.c b/libcli/smb/smbXcli_base.c
index 5135ad491fe..2f5fac08128 100644
--- a/libcli/smb/smbXcli_base.c
+++ b/libcli/smb/smbXcli_base.c
@@ -38,7 +38,7 @@
 #include "lib/crypto/aes_ccm_128.h"
 #include "lib/crypto/aes_gcm_128.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/libcli/smb/smb_signing.c b/libcli/smb/smb_signing.c
index b67702fe7c0..c75a0756821 100644
--- a/libcli/smb/smb_signing.c
+++ b/libcli/smb/smb_signing.c
@@ -23,7 +23,7 @@
 #include "smb_common.h"
 #include "smb_signing.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/libcli/smb/wscript b/libcli/smb/wscript
index 4665703fdef..2fad5ee37c3 100644
--- a/libcli/smb/wscript
+++ b/libcli/smb/wscript
@@ -47,7 +47,7 @@ def build(bld):
     ''',
     deps='''
         LIBCRYPTO gnutls NDR_SMB2_LEASE_STRUCT samba-errors gensec krb5samba
-        smb_transport
+        smb_transport GNUTLS_HELPERS
     ''',
     public_deps='talloc samba-util iov_buf',
     private_library=True,
diff --git a/libcli/util/wscript_build b/libcli/util/wscript_build
index 56a70f888e9..9c8fddca94b 100644
--- a/libcli/util/wscript_build
+++ b/libcli/util/wscript_build
@@ -2,10 +2,10 @@
 
 
 bld.SAMBA_LIBRARY('samba-errors',
-                  public_headers='error.h ntstatus.h ntstatus_gen.h doserr.h werror.h werror_gen.h hresult.h gnutls_error.h',
+                  public_headers='error.h ntstatus.h ntstatus_gen.h doserr.h werror.h werror_gen.h hresult.h',
                   private_headers='nterr_private.h',
                   header_path='core',
-                  source='doserr.c errormap.c nterr.c errmap_unix.c hresult.c gnutls_error.c',
+                  source='doserr.c errormap.c nterr.c errmap_unix.c hresult.c',
                   public_deps='talloc samba-debug',
                   deps='gnutls',
                   # private_library=True,
diff --git a/source3/smbd/smb2_server.c b/source3/smbd/smb2_server.c
index 5b4ec271ae6..c0c4a0272d1 100644
--- a/source3/smbd/smb2_server.c
+++ b/source3/smbd/smb2_server.c
@@ -32,7 +32,7 @@
 #include "auth.h"
 #include "libcli/smb/smbXcli_base.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
index eb81e237914..770c22b00f1 100644
--- a/source3/smbd/smb2_sesssetup.c
+++ b/source3/smbd/smb2_sesssetup.c
@@ -32,7 +32,7 @@
 #include "lib/crypto/aes_ccm_128.h"
 #include "lib/crypto/aes_gcm_128.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/source3/wscript_build b/source3/wscript_build
index edd973d6994..b61fc3cc95f 100644
--- a/source3/wscript_build
+++ b/source3/wscript_build
@@ -749,6 +749,7 @@ bld.SAMBA3_LIBRARY('smbd_base',
                         notifyd
                         vfs_acl_common
                         NDR_QUOTA
+                        GNUTLS_HELPERS
                    ''' +
                    bld.env['dmapi_lib'] +
                    bld.env['legacy_quota_libs'] +
diff --git a/source4/libcli/smb2/signing.c b/source4/libcli/smb2/signing.c
index 2fc10bb8532..cf488b82d77 100644
--- a/source4/libcli/smb2/signing.c
+++ b/source4/libcli/smb2/signing.c
@@ -26,7 +26,7 @@
 
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 
 /*
   sign an outgoing message
diff --git a/source4/libcli/smb2/wscript_build b/source4/libcli/smb2/wscript_build
index a15753feadf..51ac0f2c2e5 100644
--- a/source4/libcli/smb2/wscript_build
+++ b/source4/libcli/smb2/wscript_build
@@ -3,7 +3,7 @@
 bld.SAMBA_SUBSYSTEM('LIBCLI_SMB2',
 	source='transport.c request.c session.c tcon.c create.c close.c connect.c getinfo.c write.c read.c setinfo.c find.c ioctl.c logoff.c tdis.c flush.c lock.c notify.c cancel.c keepalive.c break.c util.c signing.c lease_break.c',
 	autoproto='smb2_proto.h',
-	deps='tevent-util cli_smb_common',
+	deps='tevent-util cli_smb_common GNUTLS_HELPERS',
 	public_deps='smbclient-raw gensec samba-credentials tevent',
 	private_headers='smb2.h',
 	)
diff --git a/source4/libnet/libnet_passwd.c b/source4/libnet/libnet_passwd.c
index 0f509b961cf..97ce7f58ddf 100644
--- a/source4/libnet/libnet_passwd.c
+++ b/source4/libnet/libnet_passwd.c
@@ -24,7 +24,7 @@
 #include "libcli/auth/libcli_auth.h"
 #include "librpc/gen_ndr/ndr_samr_c.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/source4/libnet/wscript_build b/source4/libnet/wscript_build
index 44bc9231cde..e097fddc228 100644
--- a/source4/libnet/wscript_build
+++ b/source4/libnet/wscript_build
@@ -8,7 +8,7 @@ auto_proto='libnet_proto.h'
 bld.SAMBA_LIBRARY(name,
         source='libnet.c libnet_passwd.c libnet_time.c libnet_rpc.c libnet_join.c libnet_site.c libnet_become_dc.c libnet_unbecome_dc.c libnet_vampire.c libnet_user.c libnet_group.c libnet_share.c libnet_lookup.c libnet_domain.c userinfo.c groupinfo.c userman.c groupman.c prereq_domain.c',
         autoproto=auto_proto,
-        public_deps='samba-credentials dcerpc dcerpc-samr RPC_NDR_LSA RPC_NDR_SRVSVC RPC_NDR_DRSUAPI cli_composite LIBCLI_RESOLVE LIBCLI_FINDDCS cli_cldap LIBCLI_FINDDCS gensec_schannel LIBCLI_AUTH ndr smbpasswdparser %s LIBCLI_SAMSYNC LIBTSOCKET' % (provision),
+        public_deps='samba-credentials dcerpc dcerpc-samr RPC_NDR_LSA RPC_NDR_SRVSVC RPC_NDR_DRSUAPI cli_composite LIBCLI_RESOLVE LIBCLI_FINDDCS cli_cldap LIBCLI_FINDDCS gensec_schannel LIBCLI_AUTH ndr smbpasswdparser %s LIBCLI_SAMSYNC LIBTSOCKET GNUTLS_HELPERS' % (provision),
         private_library=True,
         pyembed=True,
         enabled=bld.PYTHON_BUILD_IS_ENABLED()
diff --git a/source4/ntp_signd/ntp_signd.c b/source4/ntp_signd/ntp_signd.c
index b7eb2f842ac..44096f71f49 100644
--- a/source4/ntp_signd/ntp_signd.c
+++ b/source4/ntp_signd/ntp_signd.c
@@ -40,7 +40,7 @@
 #include "system/network.h"
 #include "system/passwd.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/source4/ntp_signd/wscript_build b/source4/ntp_signd/wscript_build
index a7f925df7a0..ec8a2e5b85a 100644
--- a/source4/ntp_signd/wscript_build
+++ b/source4/ntp_signd/wscript_build
@@ -4,7 +4,7 @@ bld.SAMBA_MODULE('service_ntp_signd',
 	source='ntp_signd.c',
 	subsystem='service',
 	init_function='server_service_ntp_signd_init',
-	deps='samdb NDR_NTP_SIGND LIBTSOCKET LIBSAMBA_TSOCKET',
+	deps='samdb NDR_NTP_SIGND LIBTSOCKET LIBSAMBA_TSOCKET GNUTLS_HELPERS',
 	internal_module=False,
 	enabled=bld.AD_DC_BUILD_IS_ENABLED()
 	)
diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
index 987ea42dca3..7c441f38ce2 100644
--- a/source4/rpc_server/samr/samr_password.c
+++ b/source4/rpc_server/samr/samr_password.c
@@ -32,7 +32,7 @@
 #include "rpc_server/samr/proto.h"
 #include "auth/auth_sam.h"
 
-#include "libcli/util/gnutls_error.h"
+#include "lib/crypto/gnutls_helpers.h"
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 
diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build
index 019bd2026c1..a7459d6b851 100644
--- a/source4/rpc_server/wscript_build
+++ b/source4/rpc_server/wscript_build
@@ -87,7 +87,7 @@ bld.SAMBA_MODULE('dcesrv_samr',
 	autoproto='samr/proto.h',
 	subsystem='dcerpc_server',
 	init_function='dcerpc_server_samr_init',
-	deps='samdb DCERPC_COMMON ndr-standard auth4_sam'
+	deps='samdb DCERPC_COMMON ndr-standard auth4_sam GNUTLS_HELPERS'
 	)