diff --git a/system_test/helpers.go b/system_test/helpers.go
index 24d8bee1..7f87cebc 100644
--- a/system_test/helpers.go
+++ b/system_test/helpers.go
@@ -366,10 +366,21 @@ func mustNewNode(enableSingle bool) *Node {
 }
 
 func mustNewNodeEncrypted(enableSingle, httpEncrypt, nodeEncrypt bool) *Node {
-	return mustNodeEncrypted(mustTempDir(), enableSingle, httpEncrypt, nodeEncrypt, "")
+	dir := mustTempDir()
+	var tn *tcp.Transport
+	if nodeEncrypt {
+		tn = tcp.NewTLSTransport(x509.CertFile(dir), x509.CertFile(dir), true)
+	} else {
+		tn = tcp.NewTransport()
+	}
+	if err := tn.Open("localhost:0"); err != nil {
+		panic(err.Error())
+	}
+
+	return mustNodeEncrypted(dir, enableSingle, httpEncrypt, tn, "")
 }
 
-func mustNodeEncrypted(dir string, enableSingle, httpEncrypt, nodeEncrypt bool, nodeID string) *Node {
+func mustNodeEncrypted(dir string, enableSingle, httpEncrypt bool, tn store.Listener, nodeID string) *Node {
 	nodeCertPath := x509.CertFile(dir)
 	nodeKeyPath := x509.KeyFile(dir)
 	httpCertPath := nodeCertPath
@@ -385,17 +396,6 @@ func mustNodeEncrypted(dir string, enableSingle, httpEncrypt, nodeEncrypt bool,
 
 	dbConf := store.NewDBConfig("", false)
 
-	var tn *tcp.Transport
-	if nodeEncrypt {
-		tn = tcp.NewTLSTransport(node.NodeCertPath, node.NodeCertPath, true)
-	} else {
-		tn = tcp.NewTransport()
-	}
-
-	if err := tn.Open("localhost:0"); err != nil {
-		panic(err.Error())
-	}
-
 	id := nodeID
 	if id == "" {
 		id = tn.Addr().String()
diff --git a/system_test/single_node_test.go b/system_test/single_node_test.go
index 3010b6aa..1b16d145 100644
--- a/system_test/single_node_test.go
+++ b/system_test/single_node_test.go
@@ -9,6 +9,8 @@ import (
 	"path/filepath"
 	"testing"
 	"time"
+
+	"github.com/rqlite/rqlite/tcp"
 )
 
 func Test_SingleNode(t *testing.T) {
@@ -289,7 +291,13 @@ func Test_SingleNodeRestart(t *testing.T) {
 		t.Fatalf("failed to copy node test directory: %s", err)
 	}
 
-	node := mustNodeEncrypted(destdir, true, false, false, "node1")
+	tn := tcp.NewTransport()
+	if err := tn.Open("localhost:0"); err != nil {
+		t.Fatalf("failed to open transport: %s", err)
+	}
+	defer tn.Close()
+
+	node := mustNodeEncrypted(destdir, true, false, tn, "node1")
 	defer node.Deprovision()
 	if _, err := node.WaitForLeader(); err != nil {
 		t.Fatal("node never became leader")