diff --git a/lib/tls.js b/lib/tls.js
index 32c0319754be2a..c2cbed2faf0ab1 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -235,4 +235,6 @@ exports.TLSSocket = require('_tls_wrap').TLSSocket;
 exports.Server = require('_tls_wrap').Server;
 exports.createServer = require('_tls_wrap').createServer;
 exports.connect = require('_tls_wrap').connect;
-exports.createSecurePair = require('_tls_legacy').createSecurePair;
+exports.createSecurePair = internalUtil.deprecate(function() {
+  return require('_tls_legacy').createSecurePair.apply(null, arguments);
+}, 'tls.createSecurePair is deprecated. Use tls.TLSSocket instead.');
diff --git a/test/parallel/test-tls-deprecated.js b/test/parallel/test-tls-deprecated.js
new file mode 100644
index 00000000000000..6437b784164a3a
--- /dev/null
+++ b/test/parallel/test-tls-deprecated.js
@@ -0,0 +1,11 @@
+'use strict';
+const common = require('../common');
+const tls = require('tls');
+
+common.expectWarning('DeprecationWarning', [
+  'tls.createSecurePair is deprecated. Use tls.TLSSocket instead.'
+]);
+
+try {
+  tls.createSecurePair();
+} catch (err) {}