diff --git a/cmd/ctr/commands/resolver.go b/cmd/ctr/commands/resolver.go
index 1b1811832..1acf7f318 100644
--- a/cmd/ctr/commands/resolver.go
+++ b/cmd/ctr/commands/resolver.go
@@ -149,6 +149,11 @@ func resolverDefaultTLS(clicontext *cli.Context) (*tls.Config, error) {
 		config.Certificates = []tls.Certificate{keyPair}
 	}
 
+	// If nothing was set, return nil rather than empty config
+	if !config.InsecureSkipVerify && config.RootCAs == nil && config.Certificates == nil {
+		return nil, nil
+	}
+
 	return config, nil
 }