Don't wrap conn with a TLS Client if it's already a TLS Conn

client.go

@@ -1860,7 +1860,8 @@ func dialAddr(addr string, dial DialFunc, dialDualStack, isTLS bool, tlsConfig *
 	if conn == nil {
 		panic("BUG: DialFunc returned (nil, nil)")
 	}
-	if isTLS {
+	_, isTLSAlready := conn.(*tls.Conn)
+	if isTLS && !isTLSAlready {
 		if timeout == 0 {
 			return tls.Client(conn, tlsConfig), nil
 		}