diff --git a/src/core/tsi/fake_transport_security.c b/src/core/tsi/fake_transport_security.c
index e8af200284ae2cb1daaea6be09cab3c0e9c2cdf6..f58f04ea20b8ebe17b92c43d4c8970bdd997b024 100644
--- a/src/core/tsi/fake_transport_security.c
+++ b/src/core/tsi/fake_transport_security.c
@@ -392,8 +392,10 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
     if (next_message_to_send > TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
       next_message_to_send = TSI_FAKE_HANDSHAKE_MESSAGE_MAX;
     }
-    gpr_log(GPR_INFO, "%s prepared %s.", impl->is_client ? "Client" : "Server",
-            tsi_fake_handshake_message_to_string(impl->next_message_to_send));
+    if (tsi_tracing_enabled) {
+      gpr_log(GPR_INFO, "%s prepared %s.", impl->is_client ? "Client" : "Server",
+              tsi_fake_handshake_message_to_string(impl->next_message_to_send));
+    }
     impl->next_message_to_send = next_message_to_send;
   }
   result = drain_frame_to_bytes(bytes, bytes_size, &impl->outgoing);
@@ -401,7 +403,9 @@ static tsi_result fake_handshaker_get_bytes_to_send_to_peer(
   if (!impl->is_client &&
       impl->next_message_to_send == TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
     /* We're done. */
-    gpr_log(GPR_INFO, "Server is done.");
+    if (tsi_tracing_enabled) {
+      gpr_log(GPR_INFO, "Server is done.");
+    }
     impl->result = TSI_OK;
   } else {
     impl->needs_incoming_message = 1;
@@ -436,13 +440,17 @@ static tsi_result fake_handshaker_process_bytes_from_peer(
             tsi_fake_handshake_message_to_string(received_msg),
             tsi_fake_handshake_message_to_string(expected_msg));
   }
-  gpr_log(GPR_INFO, "%s received %s.", impl->is_client ? "Client" : "Server",
-          tsi_fake_handshake_message_to_string(received_msg));
+  if (tsi_tracing_enabled) {
+    gpr_log(GPR_INFO, "%s received %s.", impl->is_client ? "Client" : "Server",
+            tsi_fake_handshake_message_to_string(received_msg));
+  }
   tsi_fake_frame_reset(&impl->incoming, 0 /* needs_draining */);
   impl->needs_incoming_message = 0;
   if (impl->next_message_to_send == TSI_FAKE_HANDSHAKE_MESSAGE_MAX) {
     /* We're done. */
-    gpr_log(GPR_INFO, "%s is done.", impl->is_client ? "Client" : "Server");
+    if (tsi_tracing_enabled) {
+      gpr_log(GPR_INFO, "%s is done.", impl->is_client ? "Client" : "Server");
+    }
     impl->result = TSI_OK;
   }
   return TSI_OK;
diff --git a/src/core/tsi/ssl_transport_security.c b/src/core/tsi/ssl_transport_security.c
index 8446cc4fdc2dff9aa388d43d23cc10f9193ed95b..dc43f7e270cf52ccc6d803a986f14311f6d583e4 100644
--- a/src/core/tsi/ssl_transport_security.c
+++ b/src/core/tsi/ssl_transport_security.c
@@ -162,7 +162,7 @@ static const char* ssl_error_string(int error) {
 /* TODO(jboeuf): Remove when we are past the debugging phase with this code. */
 static void ssl_log_where_info(const SSL* ssl, int where, int flag,
                                const char* msg) {
-  if (where & flag) {
+  if ((where & flag) && tsi_tracing_enabled) {
     gpr_log(GPR_INFO, "%20.20s - %30.30s  - %5.10s", msg,
             SSL_state_string_long(ssl), SSL_state_string(ssl));
   }
diff --git a/src/core/tsi/transport_security.c b/src/core/tsi/transport_security.c
index aeb9b3fc17d3779446a44724212cccf306ed5604..04b30004fcd6850a2bd3eaea6e571b8cd43a418f 100644
--- a/src/core/tsi/transport_security.c
+++ b/src/core/tsi/transport_security.c
@@ -36,6 +36,14 @@
 #include <stdlib.h>
 #include <string.h>
 
+/* --- Tracing. --- */
+
+int tsi_tracing_enabled = 0;
+
+void tsi_enable_tracing() {
+  tsi_tracing_enabled = 1;
+}
+
 /* --- Utils. --- */
 
 char* tsi_strdup(const char* src) {
diff --git a/src/core/tsi/transport_security.h b/src/core/tsi/transport_security.h
index e47e258e59d9edf9d5dbc2dde7c061cc1d4eaab6..59e5dcff9a2b245a4a6115c484db82e76e12a278 100644
--- a/src/core/tsi/transport_security.h
+++ b/src/core/tsi/transport_security.h
@@ -40,6 +40,8 @@
 extern "C" {
 #endif
 
+extern int tsi_tracing_enabled;
+
 /* Base for tsi_frame_protector implementations.
    See transport_security_interface.h for documentation. */
 typedef struct {
diff --git a/src/core/tsi/transport_security_interface.h b/src/core/tsi/transport_security_interface.h
index 50de7b927f2e7ef02088911e4eb8e5ad986050c0..33a19bef0def5ab30b94d581e6cf66e21437f128 100644
--- a/src/core/tsi/transport_security_interface.h
+++ b/src/core/tsi/transport_security_interface.h
@@ -61,6 +61,11 @@ typedef enum {
 
 const char* tsi_result_to_string(tsi_result result);
 
+/* --- tsi tracing --- */
+
+/* Call this function before any other tsi function to avoid races. */
+void tsi_enable_tracing(void);
+
 /* --- tsi_frame_protector object ---
 
   This object protects and unprotects buffers once the handshake is done.