diff --git a/src/core/common/instance.cpp b/src/core/common/instance.cpp
index 3f2c615eb..c93a510f5 100644
--- a/src/core/common/instance.cpp
+++ b/src/core/common/instance.cpp
@@ -145,7 +145,7 @@ Instance::Instance(void)
     , mCommissioner(*this)
 #endif
 #if OPENTHREAD_CONFIG_DTLS_ENABLE
-    , mCoapSecure(*this)
+    , mTmfSecureAgent(*this)
 #endif
 #if OPENTHREAD_CONFIG_JOINER_ENABLE
     , mJoiner(*this)
@@ -390,8 +390,8 @@ void Instance::GetBufferInfo(BufferInfo &aInfo)
     Get<Tmf::Agent>().GetCachedResponses().GetInfo(aInfo.mCoapQueue);
 
 #if OPENTHREAD_CONFIG_DTLS_ENABLE
-    Get<Coap::CoapSecure>().GetRequestMessages().GetInfo(aInfo.mCoapSecureQueue);
-    Get<Coap::CoapSecure>().GetCachedResponses().GetInfo(aInfo.mCoapSecureQueue);
+    Get<Tmf::SecureAgent>().GetRequestMessages().GetInfo(aInfo.mCoapSecureQueue);
+    Get<Tmf::SecureAgent>().GetCachedResponses().GetInfo(aInfo.mCoapSecureQueue);
 #endif
 
 #if OPENTHREAD_CONFIG_COAP_API_ENABLE
diff --git a/src/core/common/instance.hpp b/src/core/common/instance.hpp
index 39827bc3e..78e6d45e9 100644
--- a/src/core/common/instance.hpp
+++ b/src/core/common/instance.hpp
@@ -497,7 +497,7 @@ private:
 #endif
 
 #if OPENTHREAD_CONFIG_DTLS_ENABLE
-    Coap::CoapSecure mCoapSecure;
+    Tmf::SecureAgent mTmfSecureAgent;
 #endif
 
 #if OPENTHREAD_CONFIG_JOINER_ENABLE
@@ -903,9 +903,9 @@ template <> inline Tmf::Agent &Instance::Get(void)
 }
 
 #if OPENTHREAD_CONFIG_DTLS_ENABLE
-template <> inline Coap::CoapSecure &Instance::Get(void)
+template <> inline Tmf::SecureAgent &Instance::Get(void)
 {
-    return mCoapSecure;
+    return mTmfSecureAgent;
 }
 #endif
 
diff --git a/src/core/meshcop/border_agent.cpp b/src/core/meshcop/border_agent.cpp
index dc2d128c2..9e1944b17 100644
--- a/src/core/meshcop/border_agent.cpp
+++ b/src/core/meshcop/border_agent.cpp
@@ -113,13 +113,12 @@ Coap::Message::Code BorderAgent::CoapCodeFromError(Error aError)
 
 void BorderAgent::SendErrorMessage(ForwardContext &aForwardContext, Error aError)
 {
-    Error             error   = kErrorNone;
-    Coap::CoapSecure &coaps   = Get<Coap::CoapSecure>();
-    Coap::Message *   message = nullptr;
+    Error          error   = kErrorNone;
+    Coap::Message *message = nullptr;
 
-    VerifyOrExit((message = coaps.NewPriorityMessage()) != nullptr, error = kErrorNoBufs);
+    VerifyOrExit((message = Get<Tmf::SecureAgent>().NewPriorityMessage()) != nullptr, error = kErrorNoBufs);
     SuccessOrExit(error = aForwardContext.ToHeader(*message, CoapCodeFromError(aError)));
-    SuccessOrExit(error = coaps.SendMessage(*message, coaps.GetMessageInfo()));
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().SendMessage(*message, Get<Tmf::SecureAgent>().GetMessageInfo()));
 
 exit:
     FreeMessageOnError(message, error);
@@ -128,11 +127,10 @@ exit:
 
 void BorderAgent::SendErrorMessage(const Coap::Message &aRequest, bool aSeparate, Error aError)
 {
-    Error             error   = kErrorNone;
-    Coap::CoapSecure &coaps   = Get<Coap::CoapSecure>();
-    Coap::Message *   message = nullptr;
+    Error          error   = kErrorNone;
+    Coap::Message *message = nullptr;
 
-    VerifyOrExit((message = coaps.NewPriorityMessage()) != nullptr, error = kErrorNoBufs);
+    VerifyOrExit((message = Get<Tmf::SecureAgent>().NewPriorityMessage()) != nullptr, error = kErrorNoBufs);
 
     if (aRequest.IsNonConfirmable() || aSeparate)
     {
@@ -150,7 +148,7 @@ void BorderAgent::SendErrorMessage(const Coap::Message &aRequest, bool aSeparate
 
     SuccessOrExit(error = message->SetTokenFromMessage(aRequest));
 
-    SuccessOrExit(error = coaps.SendMessage(*message, coaps.GetMessageInfo()));
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().SendMessage(*message, Get<Tmf::SecureAgent>().GetMessageInfo()));
 
 exit:
     FreeMessageOnError(message, error);
@@ -175,7 +173,7 @@ void BorderAgent::HandleCoapResponse(ForwardContext &aForwardContext, const Coap
     Error          error;
 
     SuccessOrExit(error = aResult);
-    VerifyOrExit((message = Get<Coap::CoapSecure>().NewPriorityMessage()) != nullptr, error = kErrorNoBufs);
+    VerifyOrExit((message = Get<Tmf::SecureAgent>().NewPriorityMessage()) != nullptr, error = kErrorNoBufs);
 
     if (aForwardContext.IsPetition() && aResponse->GetCode() == Coap::kCodeChanged)
     {
@@ -221,65 +219,8 @@ exit:
     Heap::Free(&aForwardContext);
 }
 
-template <Coap::Resource BorderAgent::*aResource>
-void BorderAgent::HandleRequest(void *aContext, otMessage *aMessage, const otMessageInfo *aMessageInfo)
-{
-    IgnoreError(static_cast<BorderAgent *>(aContext)->ForwardToLeader(
-        AsCoapMessage(aMessage), AsCoreType(aMessageInfo),
-        UriFromPath((static_cast<BorderAgent *>(aContext)->*aResource).GetUriPath()), false, false));
-}
-
-template <>
-void BorderAgent::HandleRequest<&BorderAgent::mCommissionerPetition>(void *               aContext,
-                                                                     otMessage *          aMessage,
-                                                                     const otMessageInfo *aMessageInfo)
-{
-    IgnoreError(static_cast<BorderAgent *>(aContext)->ForwardToLeader(AsCoapMessage(aMessage), AsCoreType(aMessageInfo),
-                                                                      kUriLeaderPetition, true, true));
-}
-
-template <>
-void BorderAgent::HandleRequest<&BorderAgent::mCommissionerKeepAlive>(void *               aContext,
-                                                                      otMessage *          aMessage,
-                                                                      const otMessageInfo *aMessageInfo)
-{
-    static_cast<BorderAgent *>(aContext)->HandleKeepAlive(AsCoapMessage(aMessage), AsCoreType(aMessageInfo));
-}
-
-template <>
-void BorderAgent::HandleRequest<&BorderAgent::mRelayTransmit>(void *               aContext,
-                                                              otMessage *          aMessage,
-                                                              const otMessageInfo *aMessageInfo)
-{
-    OT_UNUSED_VARIABLE(aMessageInfo);
-    static_cast<BorderAgent *>(aContext)->HandleRelayTransmit(AsCoapMessage(aMessage));
-}
-
-template <>
-void BorderAgent::HandleRequest<&BorderAgent::mProxyTransmit>(void *               aContext,
-                                                              otMessage *          aMessage,
-                                                              const otMessageInfo *aMessageInfo)
-{
-    OT_UNUSED_VARIABLE(aMessageInfo);
-    static_cast<BorderAgent *>(aContext)->HandleProxyTransmit(AsCoapMessage(aMessage));
-}
-
 BorderAgent::BorderAgent(Instance &aInstance)
     : InstanceLocator(aInstance)
-    , mCommissionerPetition(kUriCommissionerPetition,
-                            BorderAgent::HandleRequest<&BorderAgent::mCommissionerPetition>,
-                            this)
-    , mCommissionerKeepAlive(kUriCommissionerKeepAlive,
-                             BorderAgent::HandleRequest<&BorderAgent::mCommissionerKeepAlive>,
-                             this)
-    , mRelayTransmit(kUriRelayTx, BorderAgent::HandleRequest<&BorderAgent::mRelayTransmit>, this)
-    , mCommissionerGet(kUriCommissionerGet, BorderAgent::HandleRequest<&BorderAgent::mCommissionerGet>, this)
-    , mCommissionerSet(kUriCommissionerSet, BorderAgent::HandleRequest<&BorderAgent::mCommissionerSet>, this)
-    , mActiveGet(kUriActiveGet, BorderAgent::HandleRequest<&BorderAgent::mActiveGet>, this)
-    , mActiveSet(kUriActiveSet, BorderAgent::HandleRequest<&BorderAgent::mActiveSet>, this)
-    , mPendingGet(kUriPendingGet, BorderAgent::HandleRequest<&BorderAgent::mPendingGet>, this)
-    , mPendingSet(kUriPendingSet, BorderAgent::HandleRequest<&BorderAgent::mPendingSet>, this)
-    , mProxyTransmit(kUriProxyTx, BorderAgent::HandleRequest<&BorderAgent::mProxyTransmit>, this)
     , mUdpReceiver(BorderAgent::HandleUdpReceive, this)
     , mTimer(aInstance)
     , mState(kStateStopped)
@@ -309,14 +250,18 @@ exit:
     return;
 }
 
-void BorderAgent::HandleProxyTransmit(const Coap::Message &aMessage)
+template <> void BorderAgent::HandleTmf<kUriProxyTx>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
 {
+    OT_UNUSED_VARIABLE(aMessageInfo);
+
     Message *           message = nullptr;
     Ip6::MessageInfo    messageInfo;
     uint16_t            offset;
-    Error               error;
+    Error               error = kErrorNone;
     UdpEncapsulationTlv tlv;
 
+    VerifyOrExit(mState != kStateStopped);
+
     SuccessOrExit(error = Tlv::FindTlvOffset(aMessage, Tlv::kUdpEncapsulation, offset));
     SuccessOrExit(error = aMessage.Read(offset, tlv));
 
@@ -357,7 +302,7 @@ bool BorderAgent::HandleUdpReceive(const Message &aMessage, const Ip6::MessageIn
 
     VerifyOrExit(aMessage.GetLength() > 0, error = kErrorNone);
 
-    message = Get<Coap::CoapSecure>().NewPriorityNonConfirmablePostMessage(kUriProxyRx);
+    message = Get<Tmf::SecureAgent>().NewPriorityNonConfirmablePostMessage(kUriProxyRx);
     VerifyOrExit(message != nullptr, error = kErrorNoBufs);
 
     {
@@ -378,7 +323,7 @@ bool BorderAgent::HandleUdpReceive(const Message &aMessage, const Ip6::MessageIn
 
     SuccessOrExit(error = Tlv::Append<Ip6AddressTlv>(*message, aMessageInfo.GetPeerAddr()));
 
-    SuccessOrExit(error = Get<Coap::CoapSecure>().SendMessage(*message, Get<Coap::CoapSecure>().GetMessageInfo()));
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().SendMessage(*message, Get<Tmf::SecureAgent>().GetMessageInfo()));
 
     LogInfo("Sent to commissioner on ProxyRx (c/ur)");
 
@@ -403,7 +348,7 @@ template <> void BorderAgent::HandleTmf<kUriRelayRx>(Coap::Message &aMessage, co
 
     VerifyOrExit(aMessage.IsNonConfirmablePostRequest(), error = kErrorDrop);
 
-    message = Get<Coap::CoapSecure>().NewPriorityNonConfirmablePostMessage(kUriRelayRx);
+    message = Get<Tmf::SecureAgent>().NewPriorityNonConfirmablePostMessage(kUriRelayRx);
     VerifyOrExit(message != nullptr, error = kErrorNoBufs);
 
     SuccessOrExit(error = ForwardToCommissioner(*message, aMessage));
@@ -423,7 +368,7 @@ Error BorderAgent::ForwardToCommissioner(Coap::Message &aForwardMessage, const M
     aMessage.CopyTo(aMessage.GetOffset(), offset, aMessage.GetLength() - aMessage.GetOffset(), aForwardMessage);
 
     SuccessOrExit(error =
-                      Get<Coap::CoapSecure>().SendMessage(aForwardMessage, Get<Coap::CoapSecure>().GetMessageInfo()));
+                      Get<Tmf::SecureAgent>().SendMessage(aForwardMessage, Get<Tmf::SecureAgent>().GetMessageInfo()));
 
     LogInfo("Sent to commissioner");
 
@@ -432,26 +377,68 @@ exit:
     return error;
 }
 
-void BorderAgent::HandleKeepAlive(const Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+template <>
+void BorderAgent::HandleTmf<kUriCommissionerPetition>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
 {
-    Error error;
-
-    error = ForwardToLeader(aMessage, aMessageInfo, kUriLeaderKeepAlive, false, true);
-
-    if (error == kErrorNone)
-    {
-        mTimer.Start(kKeepAliveTimeout);
-    }
+    IgnoreError(ForwardToLeader(aMessage, aMessageInfo, kUriLeaderPetition, true, true));
 }
 
-void BorderAgent::HandleRelayTransmit(const Coap::Message &aMessage)
+template <>
+void BorderAgent::HandleTmf<kUriCommissionerGet>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
 {
+    IgnoreError(ForwardToLeader(aMessage, aMessageInfo, kUriCommissionerGet, false, false));
+}
+
+template <>
+void BorderAgent::HandleTmf<kUriCommissionerSet>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    IgnoreError(ForwardToLeader(aMessage, aMessageInfo, kUriCommissionerSet, false, false));
+}
+
+template <> void BorderAgent::HandleTmf<kUriActiveGet>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    IgnoreError(ForwardToLeader(aMessage, aMessageInfo, kUriActiveGet, false, false));
+}
+
+template <> void BorderAgent::HandleTmf<kUriActiveSet>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    IgnoreError(ForwardToLeader(aMessage, aMessageInfo, kUriActiveSet, false, false));
+}
+
+template <> void BorderAgent::HandleTmf<kUriPendingGet>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    IgnoreError(ForwardToLeader(aMessage, aMessageInfo, kUriPendingGet, false, false));
+}
+
+template <> void BorderAgent::HandleTmf<kUriPendingSet>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    IgnoreError(ForwardToLeader(aMessage, aMessageInfo, kUriPendingSet, false, false));
+}
+
+template <>
+void BorderAgent::HandleTmf<kUriCommissionerKeepAlive>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    VerifyOrExit(mState != kStateStopped);
+
+    SuccessOrExit(ForwardToLeader(aMessage, aMessageInfo, kUriLeaderKeepAlive, false, true));
+    mTimer.Start(kKeepAliveTimeout);
+
+exit:
+    return;
+}
+
+template <> void BorderAgent::HandleTmf<kUriRelayTx>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    OT_UNUSED_VARIABLE(aMessageInfo);
+
     Error            error = kErrorNone;
     uint16_t         joinerRouterRloc;
     Coap::Message *  message = nullptr;
     Tmf::MessageInfo messageInfo(GetInstance());
     uint16_t         offset = 0;
 
+    VerifyOrExit(mState != kStateStopped);
+
     VerifyOrExit(aMessage.IsNonConfirmablePostRequest());
 
     SuccessOrExit(error = Tlv::Find<JoinerRouterLocatorTlv>(aMessage, joinerRouterRloc));
@@ -487,11 +474,11 @@ Error BorderAgent::ForwardToLeader(const Coap::Message &   aMessage,
     Coap::Message *  message = nullptr;
     uint16_t         offset  = 0;
 
-    VerifyOrExit(aUri != kUriUnknown);
+    VerifyOrExit(mState != kStateStopped);
 
     if (aSeparate)
     {
-        SuccessOrExit(error = Get<Coap::CoapSecure>().SendAck(aMessage, aMessageInfo));
+        SuccessOrExit(error = Get<Tmf::SecureAgent>().SendAck(aMessage, aMessageInfo));
     }
 
     forwardContext = static_cast<ForwardContext *>(Heap::CAlloc(1, sizeof(ForwardContext)));
@@ -558,34 +545,22 @@ void BorderAgent::HandleConnected(bool aConnected)
 
 uint16_t BorderAgent::GetUdpPort(void) const
 {
-    return Get<Coap::CoapSecure>().GetUdpPort();
+    return Get<Tmf::SecureAgent>().GetUdpPort();
 }
 
 void BorderAgent::Start(void)
 {
-    Error             error;
-    Coap::CoapSecure &coaps = Get<Coap::CoapSecure>();
-    Pskc              pskc;
+    Error error;
+    Pskc  pskc;
 
     VerifyOrExit(mState == kStateStopped, error = kErrorNone);
 
     Get<KeyManager>().GetPskc(pskc);
-    SuccessOrExit(error = coaps.Start(kBorderAgentUdpPort));
-    SuccessOrExit(error = coaps.SetPsk(pskc.m8, Pskc::kSize));
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().Start(kBorderAgentUdpPort));
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().SetPsk(pskc.m8, Pskc::kSize));
 
     pskc.Clear();
-    coaps.SetConnectedCallback(HandleConnected, this);
-
-    coaps.AddResource(mActiveGet);
-    coaps.AddResource(mActiveSet);
-    coaps.AddResource(mPendingGet);
-    coaps.AddResource(mPendingSet);
-    coaps.AddResource(mCommissionerPetition);
-    coaps.AddResource(mCommissionerKeepAlive);
-    coaps.AddResource(mCommissionerSet);
-    coaps.AddResource(mCommissionerGet);
-    coaps.AddResource(mProxyTransmit);
-    coaps.AddResource(mRelayTransmit);
+    Get<Tmf::SecureAgent>().SetConnectedCallback(HandleConnected, this);
 
     mState        = kStateStarted;
     mUdpProxyPort = 0;
@@ -601,33 +576,19 @@ exit:
 
 void BorderAgent::HandleTimeout(void)
 {
-    if (Get<Coap::CoapSecure>().IsConnected())
+    if (Get<Tmf::SecureAgent>().IsConnected())
     {
-        Get<Coap::CoapSecure>().Disconnect();
+        Get<Tmf::SecureAgent>().Disconnect();
         LogWarn("Reset commissioner session");
     }
 }
 
 void BorderAgent::Stop(void)
 {
-    Coap::CoapSecure &coaps = Get<Coap::CoapSecure>();
-
     VerifyOrExit(mState != kStateStopped);
 
     mTimer.Stop();
-
-    coaps.RemoveResource(mCommissionerPetition);
-    coaps.RemoveResource(mCommissionerKeepAlive);
-    coaps.RemoveResource(mCommissionerSet);
-    coaps.RemoveResource(mCommissionerGet);
-    coaps.RemoveResource(mActiveGet);
-    coaps.RemoveResource(mActiveSet);
-    coaps.RemoveResource(mPendingGet);
-    coaps.RemoveResource(mPendingSet);
-    coaps.RemoveResource(mProxyTransmit);
-    coaps.RemoveResource(mRelayTransmit);
-
-    coaps.Stop();
+    Get<Tmf::SecureAgent>().Stop();
 
     mState        = kStateStopped;
     mUdpProxyPort = 0;
diff --git a/src/core/meshcop/border_agent.hpp b/src/core/meshcop/border_agent.hpp
index 8e7e09df2..a6113d423 100644
--- a/src/core/meshcop/border_agent.hpp
+++ b/src/core/meshcop/border_agent.hpp
@@ -56,6 +56,7 @@ class BorderAgent : public InstanceLocator, private NonCopyable
 {
     friend class ot::Notifier;
     friend class Tmf::Agent;
+    friend class Tmf::SecureAgent;
 
 public:
     /**
@@ -149,9 +150,6 @@ private:
 
     template <Uri kUri> void HandleTmf(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
 
-    template <Coap::Resource BorderAgent::*aResource>
-    static void HandleRequest(void *aContext, otMessage *aMessage, const otMessageInfo *aMessageInfo);
-
     void HandleTimeout(void);
 
     static void HandleCoapResponse(void *               aContext,
@@ -166,9 +164,6 @@ private:
                                 bool                    aPetition,
                                 bool                    aSeparate);
     Error       ForwardToCommissioner(Coap::Message &aForwardMessage, const Message &aMessage);
-    void        HandleKeepAlive(const Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
-    void        HandleRelayTransmit(const Coap::Message &aMessage);
-    void        HandleProxyTransmit(const Coap::Message &aMessage);
     static bool HandleUdpReceive(void *aContext, const otMessage *aMessage, const otMessageInfo *aMessageInfo)
     {
         return static_cast<BorderAgent *>(aContext)->HandleUdpReceive(AsCoreType(aMessage), AsCoreType(aMessageInfo));
@@ -181,17 +176,6 @@ private:
 
     Ip6::MessageInfo mMessageInfo;
 
-    Coap::Resource mCommissionerPetition;
-    Coap::Resource mCommissionerKeepAlive;
-    Coap::Resource mRelayTransmit;
-    Coap::Resource mCommissionerGet;
-    Coap::Resource mCommissionerSet;
-    Coap::Resource mActiveGet;
-    Coap::Resource mActiveSet;
-    Coap::Resource mPendingGet;
-    Coap::Resource mPendingSet;
-    Coap::Resource mProxyTransmit;
-
     Ip6::Udp::Receiver         mUdpReceiver; ///< The UDP receiver to receive packets from external commissioner
     Ip6::Netif::UnicastAddress mCommissionerAloc;
 
@@ -201,6 +185,16 @@ private:
 };
 
 DeclareTmfHandler(BorderAgent, kUriRelayRx);
+DeclareTmfHandler(BorderAgent, kUriCommissionerPetition);
+DeclareTmfHandler(BorderAgent, kUriCommissionerKeepAlive);
+DeclareTmfHandler(BorderAgent, kUriRelayTx);
+DeclareTmfHandler(BorderAgent, kUriCommissionerGet);
+DeclareTmfHandler(BorderAgent, kUriCommissionerSet);
+DeclareTmfHandler(BorderAgent, kUriActiveGet);
+DeclareTmfHandler(BorderAgent, kUriActiveSet);
+DeclareTmfHandler(BorderAgent, kUriPendingGet);
+DeclareTmfHandler(BorderAgent, kUriPendingSet);
+DeclareTmfHandler(BorderAgent, kUriProxyTx);
 
 } // namespace MeshCoP
 
diff --git a/src/core/meshcop/commissioner.cpp b/src/core/meshcop/commissioner.cpp
index 331d74e49..7b1bccd9c 100644
--- a/src/core/meshcop/commissioner.cpp
+++ b/src/core/meshcop/commissioner.cpp
@@ -66,7 +66,6 @@ Commissioner::Commissioner(Instance &aInstance)
     , mTransmitAttempts(0)
     , mJoinerExpirationTimer(aInstance)
     , mTimer(aInstance)
-    , mJoinerFinalize(kUriJoinerFinalize, &Commissioner::HandleJoinerFinalize, this)
     , mAnnounceBegin(aInstance)
     , mEnergyScan(aInstance)
     , mPanIdQuery(aInstance)
@@ -137,22 +136,12 @@ exit:
     return;
 }
 
-void Commissioner::AddCoapResources(void)
+void Commissioner::HandleSecureAgentConnected(bool aConnected, void *aContext)
 {
-    Get<Coap::CoapSecure>().AddResource(mJoinerFinalize);
+    static_cast<Commissioner *>(aContext)->HandleSecureAgentConnected(aConnected);
 }
 
-void Commissioner::RemoveCoapResources(void)
-{
-    Get<Coap::CoapSecure>().RemoveResource(mJoinerFinalize);
-}
-
-void Commissioner::HandleCoapsConnected(bool aConnected, void *aContext)
-{
-    static_cast<Commissioner *>(aContext)->HandleCoapsConnected(aConnected);
-}
-
-void Commissioner::HandleCoapsConnected(bool aConnected)
+void Commissioner::HandleSecureAgentConnected(bool aConnected)
 {
     SignalJoinerEvent(aConnected ? kJoinerEventConnected : kJoinerEventEnd, mActiveJoiner);
 }
@@ -303,8 +292,8 @@ Error Commissioner::Start(StateCallback aStateCallback, JoinerCallback aJoinerCa
     Get<BorderAgent>().Stop();
 #endif
 
-    SuccessOrExit(error = Get<Coap::CoapSecure>().Start(SendRelayTransmit, this));
-    Get<Coap::CoapSecure>().SetConnectedCallback(&Commissioner::HandleCoapsConnected, this);
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().Start(SendRelayTransmit, this));
+    Get<Tmf::SecureAgent>().SetConnectedCallback(&Commissioner::HandleSecureAgentConnected, this);
 
     mStateCallback    = aStateCallback;
     mJoinerCallback   = aJoinerCallback;
@@ -319,7 +308,7 @@ Error Commissioner::Start(StateCallback aStateCallback, JoinerCallback aJoinerCa
 exit:
     if ((error != kErrorNone) && (error != kErrorAlready))
     {
-        Get<Coap::CoapSecure>().Stop();
+        Get<Tmf::SecureAgent>().Stop();
     }
 
     LogError("start commissioner", error);
@@ -333,12 +322,11 @@ Error Commissioner::Stop(ResignMode aResignMode)
 
     VerifyOrExit(mState != kStateDisabled, error = kErrorAlready);
 
-    Get<Coap::CoapSecure>().Stop();
+    Get<Tmf::SecureAgent>().Stop();
 
     if (mState == kStateActive)
     {
         Get<ThreadNetif>().RemoveUnicastAddress(mCommissionerAloc);
-        RemoveCoapResources();
         ClearJoiners();
         needResign = true;
     }
@@ -879,7 +867,6 @@ void Commissioner::HandleLeaderPetitionResponse(Coap::Message *         aMessage
     IgnoreError(Get<Mle::MleRouter>().GetCommissionerAloc(mCommissionerAloc.GetAddress(), mSessionId));
     Get<ThreadNetif>().AddUnicastAddress(mCommissionerAloc);
 
-    AddCoapResources();
     SetState(kStateActive);
 
     mTransmitAttempts = 0;
@@ -985,7 +972,7 @@ template <> void Commissioner::HandleTmf<kUriRelayRx>(Coap::Message &aMessage, c
     SuccessOrExit(error = Tlv::FindTlvValueOffset(aMessage, Tlv::kJoinerDtlsEncapsulation, offset, length));
     VerifyOrExit(length <= aMessage.GetLength() - offset, error = kErrorParse);
 
-    if (!Get<Coap::CoapSecure>().IsConnectionActive())
+    if (!Get<Tmf::SecureAgent>().IsConnectionActive())
     {
         Mac::ExtAddress receivedId;
         Joiner *        joiner;
@@ -996,7 +983,7 @@ template <> void Commissioner::HandleTmf<kUriRelayRx>(Coap::Message &aMessage, c
         joiner = FindBestMatchingJoinerEntry(receivedId);
         VerifyOrExit(joiner != nullptr);
 
-        Get<Coap::CoapSecure>().SetPsk(joiner->mPskd);
+        Get<Tmf::SecureAgent>().SetPsk(joiner->mPskd);
         mActiveJoiner = joiner;
 
         LogJoinerEntry("Starting new session with", *joiner);
@@ -1019,7 +1006,7 @@ template <> void Commissioner::HandleTmf<kUriRelayRx>(Coap::Message &aMessage, c
     joinerMessageInfo.GetPeerAddr().SetIid(mJoinerIid);
     joinerMessageInfo.SetPeerPort(mJoinerPort);
 
-    Get<Coap::CoapSecure>().HandleUdpReceive(aMessage, joinerMessageInfo);
+    Get<Tmf::SecureAgent>().HandleUdpReceive(aMessage, joinerMessageInfo);
 
 exit:
     return;
@@ -1041,18 +1028,16 @@ exit:
     return;
 }
 
-void Commissioner::HandleJoinerFinalize(void *aContext, otMessage *aMessage, const otMessageInfo *aMessageInfo)
-{
-    static_cast<Commissioner *>(aContext)->HandleJoinerFinalize(AsCoapMessage(aMessage), AsCoreType(aMessageInfo));
-}
-
-void Commissioner::HandleJoinerFinalize(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+template <>
+void Commissioner::HandleTmf<kUriJoinerFinalize>(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
 {
     OT_UNUSED_VARIABLE(aMessageInfo);
 
     StateTlv::State    state = StateTlv::kAccept;
     ProvisioningUrlTlv provisioningUrl;
 
+    VerifyOrExit(mState == kStateActive);
+
     LogInfo("received joiner finalize");
 
     if (Tlv::FindTlv(aMessage, provisioningUrl) == kErrorNone)
@@ -1077,6 +1062,9 @@ void Commissioner::HandleJoinerFinalize(Coap::Message &aMessage, const Ip6::Mess
 #endif
 
     SendJoinFinalizeResponse(aMessage, state);
+
+exit:
+    return;
 }
 
 void Commissioner::SendJoinFinalizeResponse(const Coap::Message &aRequest, StateTlv::State aState)
@@ -1085,7 +1073,7 @@ void Commissioner::SendJoinFinalizeResponse(const Coap::Message &aRequest, State
     Ip6::MessageInfo joinerMessageInfo;
     Coap::Message *  message;
 
-    message = Get<Coap::CoapSecure>().NewPriorityResponseMessage(aRequest);
+    message = Get<Tmf::SecureAgent>().NewPriorityResponseMessage(aRequest);
     VerifyOrExit(message != nullptr, error = kErrorNoBufs);
 
     message->SetOffset(message->GetLength());
@@ -1105,7 +1093,7 @@ void Commissioner::SendJoinFinalizeResponse(const Coap::Message &aRequest, State
     DumpCert("[THCI] direction=send | type=JOIN_FIN.rsp |", buf, message->GetLength() - message->GetOffset());
 #endif
 
-    SuccessOrExit(error = Get<Coap::CoapSecure>().SendMessage(*message, joinerMessageInfo));
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().SendMessage(*message, joinerMessageInfo));
 
     SignalJoinerEvent(kJoinerEventFinalize, mActiveJoiner);
 
diff --git a/src/core/meshcop/commissioner.hpp b/src/core/meshcop/commissioner.hpp
index 846e503c7..0dceef69b 100644
--- a/src/core/meshcop/commissioner.hpp
+++ b/src/core/meshcop/commissioner.hpp
@@ -65,6 +65,7 @@ namespace MeshCoP {
 class Commissioner : public InstanceLocator, private NonCopyable
 {
     friend class Tmf::Agent;
+    friend class Tmf::SecureAgent;
 
 public:
     /**
@@ -541,9 +542,6 @@ private:
     Error RemoveJoiner(const Mac::ExtAddress *aEui64, const JoinerDiscerner *aDiscerner, uint32_t aDelay);
     void  RemoveJoiner(Joiner &aJoiner, uint32_t aDelay);
 
-    void AddCoapResources(void);
-    void RemoveCoapResources(void);
-
     void HandleTimer(void);
     void HandleJoinerExpirationTimer(void);
 
@@ -574,16 +572,13 @@ private:
                                               Error                aResult);
     void HandleLeaderKeepAliveResponse(Coap::Message *aMessage, const Ip6::MessageInfo *aMessageInfo, Error aResult);
 
-    static void HandleCoapsConnected(bool aConnected, void *aContext);
-    void        HandleCoapsConnected(bool aConnected);
+    static void HandleSecureAgentConnected(bool aConnected, void *aContext);
+    void        HandleSecureAgentConnected(bool aConnected);
 
     template <Uri kUri> void HandleTmf(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
 
     void HandleRelayReceive(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
 
-    static void HandleJoinerFinalize(void *aContext, otMessage *aMessage, const otMessageInfo *aMessageInfo);
-    void        HandleJoinerFinalize(Coap::Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
-
     void SendJoinFinalizeResponse(const Coap::Message &aRequest, StateTlv::State aState);
 
     static Error SendRelayTransmit(void *aContext, Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
@@ -615,8 +610,6 @@ private:
     JoinerExpirationTimer    mJoinerExpirationTimer;
     CommissionerTimer        mTimer;
 
-    Coap::Resource mJoinerFinalize;
-
     AnnounceBeginClient mAnnounceBegin;
     EnergyScanClient    mEnergyScan;
     PanIdQueryClient    mPanIdQuery;
@@ -635,6 +628,7 @@ private:
 
 DeclareTmfHandler(Commissioner, kUriDatasetChanged);
 DeclareTmfHandler(Commissioner, kUriRelayRx);
+DeclareTmfHandler(Commissioner, kUriJoinerFinalize);
 
 } // namespace MeshCoP
 
diff --git a/src/core/meshcop/joiner.cpp b/src/core/meshcop/joiner.cpp
index ca4f0afa3..c641a6d20 100644
--- a/src/core/meshcop/joiner.cpp
+++ b/src/core/meshcop/joiner.cpp
@@ -157,8 +157,8 @@ Error Joiner::Start(const char *     aPskd,
     Get<Mac::Mac>().SetExtAddress(randomAddress);
     Get<Mle::MleRouter>().UpdateLinkLocalAddress();
 
-    SuccessOrExit(error = Get<Coap::CoapSecure>().Start(kJoinerUdpPort));
-    Get<Coap::CoapSecure>().SetPsk(joinerPskd);
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().Start(kJoinerUdpPort));
+    Get<Tmf::SecureAgent>().SetPsk(joinerPskd);
 
     for (JoinerRouter &router : mJoinerRouters)
     {
@@ -215,14 +215,14 @@ void Joiner::Finish(Error aError)
     case kStateConnected:
     case kStateEntrust:
     case kStateJoined:
-        Get<Coap::CoapSecure>().Disconnect();
+        Get<Tmf::SecureAgent>().Disconnect();
         IgnoreError(Get<Ip6::Filter>().RemoveUnsecurePort(kJoinerUdpPort));
         mTimer.Stop();
 
         OT_FALL_THROUGH;
 
     case kStateDiscover:
-        Get<Coap::CoapSecure>().Stop();
+        Get<Tmf::SecureAgent>().Stop();
         break;
     }
 
@@ -394,7 +394,7 @@ Error Joiner::Connect(JoinerRouter &aRouter)
 
     sockAddr.GetAddress().SetToLinkLocalAddress(aRouter.mExtAddr);
 
-    SuccessOrExit(error = Get<Coap::CoapSecure>().Connect(sockAddr, Joiner::HandleSecureCoapClientConnect, this));
+    SuccessOrExit(error = Get<Tmf::SecureAgent>().Connect(sockAddr, Joiner::HandleSecureCoapClientConnect, this));
 
     SetState(kStateConnect);
 
@@ -440,7 +440,7 @@ Error Joiner::PrepareJoinerFinalizeMessage(const char *aProvisioningUrl,
     VendorStackVersionTlv vendorStackVersionTlv;
     ProvisioningUrlTlv    provisioningUrlTlv;
 
-    mFinalizeMessage = Get<Coap::CoapSecure>().NewPriorityConfirmablePostMessage(kUriJoinerFinalize);
+    mFinalizeMessage = Get<Tmf::SecureAgent>().NewPriorityConfirmablePostMessage(kUriJoinerFinalize);
     VerifyOrExit(mFinalizeMessage != nullptr, error = kErrorNoBufs);
 
     mFinalizeMessage->SetOffset(mFinalizeMessage->GetLength());
@@ -510,7 +510,7 @@ void Joiner::SendJoinerFinalize(void)
     LogCertMessage("[THCI] direction=send | type=JOIN_FIN.req |", *mFinalizeMessage);
 #endif
 
-    SuccessOrExit(Get<Coap::CoapSecure>().SendMessage(*mFinalizeMessage, Joiner::HandleJoinerFinalizeResponse, this));
+    SuccessOrExit(Get<Tmf::SecureAgent>().SendMessage(*mFinalizeMessage, Joiner::HandleJoinerFinalizeResponse, this));
     mFinalizeMessage = nullptr;
 
     LogInfo("Joiner sent finalize");
@@ -551,7 +551,7 @@ void Joiner::HandleJoinerFinalizeResponse(Coap::Message *aMessage, const Ip6::Me
 #endif
 
 exit:
-    Get<Coap::CoapSecure>().Disconnect();
+    Get<Tmf::SecureAgent>().Disconnect();
     IgnoreError(Get<Ip6::Filter>().RemoveUnsecurePort(kJoinerUdpPort));
 }
 
diff --git a/src/core/thread/thread_netif.cpp b/src/core/thread/thread_netif.cpp
index 3866d0d3c..1ed533990 100644
--- a/src/core/thread/thread_netif.cpp
+++ b/src/core/thread/thread_netif.cpp
@@ -98,7 +98,7 @@ void ThreadNetif::Down(void)
     Get<Dns::ServiceDiscovery::Server>().Stop();
 #endif
 #if OPENTHREAD_CONFIG_DTLS_ENABLE
-    Get<Coap::CoapSecure>().Stop();
+    Get<Tmf::SecureAgent>().Stop();
 #endif
     IgnoreError(Get<Tmf::Agent>().Stop());
     IgnoreError(Get<Mle::MleRouter>().Disable());
diff --git a/src/core/thread/tmf.cpp b/src/core/thread/tmf.cpp
index d3eada012..630b42f61 100644
--- a/src/core/thread/tmf.cpp
+++ b/src/core/thread/tmf.cpp
@@ -228,5 +228,65 @@ exit:
     return isTmf;
 }
 
+#if OPENTHREAD_CONFIG_DTLS_ENABLE
+
+SecureAgent::SecureAgent(Instance &aInstance)
+    : Coap::CoapSecure(aInstance)
+{
+    SetResourceHandler(&HandleResource);
+}
+
+bool SecureAgent::HandleResource(CoapBase &              aCoapBase,
+                                 const char *            aUriPath,
+                                 Message &               aMessage,
+                                 const Ip6::MessageInfo &aMessageInfo)
+{
+    return static_cast<SecureAgent &>(aCoapBase).HandleResource(aUriPath, aMessage, aMessageInfo);
+}
+
+bool SecureAgent::HandleResource(const char *aUriPath, Message &aMessage, const Ip6::MessageInfo &aMessageInfo)
+{
+    OT_UNUSED_VARIABLE(aMessage);
+    OT_UNUSED_VARIABLE(aMessageInfo);
+
+    bool didHandle = true;
+    Uri  uri       = UriFromPath(aUriPath);
+
+#define Case(kUri, Type)                                     \
+    case kUri:                                               \
+        Get<Type>().HandleTmf<kUri>(aMessage, aMessageInfo); \
+        break
+
+    switch (uri)
+    {
+#if OPENTHREAD_FTD && OPENTHREAD_CONFIG_COMMISSIONER_ENABLE
+        Case(kUriJoinerFinalize, MeshCoP::Commissioner);
+#endif
+
+#if OPENTHREAD_CONFIG_BORDER_AGENT_ENABLE
+        Case(kUriCommissionerPetition, MeshCoP::BorderAgent);
+        Case(kUriCommissionerKeepAlive, MeshCoP::BorderAgent);
+        Case(kUriRelayTx, MeshCoP::BorderAgent);
+        Case(kUriCommissionerGet, MeshCoP::BorderAgent);
+        Case(kUriCommissionerSet, MeshCoP::BorderAgent);
+        Case(kUriActiveGet, MeshCoP::BorderAgent);
+        Case(kUriActiveSet, MeshCoP::BorderAgent);
+        Case(kUriPendingGet, MeshCoP::BorderAgent);
+        Case(kUriPendingSet, MeshCoP::BorderAgent);
+        Case(kUriProxyTx, MeshCoP::BorderAgent);
+#endif
+
+    default:
+        didHandle = false;
+        break;
+    }
+
+#undef Case
+
+    return didHandle;
+}
+
+#endif // OPENTHREAD_CONFIG_DTLS_ENABLE
+
 } // namespace Tmf
 } // namespace ot
diff --git a/src/core/thread/tmf.hpp b/src/core/thread/tmf.hpp
index 3f40c2c37..2c0ccaf57 100644
--- a/src/core/thread/tmf.hpp
+++ b/src/core/thread/tmf.hpp
@@ -37,6 +37,7 @@
 #include "openthread-core-config.h"
 
 #include "coap/coap.hpp"
+#include "coap/coap_secure.hpp"
 #include "common/locator.hpp"
 
 namespace ot {
@@ -193,6 +194,33 @@ private:
     static Error Filter(const Message &aMessage, const Ip6::MessageInfo &aMessageInfo, void *aContext);
 };
 
+#if OPENTHREAD_CONFIG_DTLS_ENABLE
+
+/**
+ * This class implements functionality of the secure TMF agent.
+ *
+ */
+class SecureAgent : public Coap::CoapSecure
+{
+public:
+    /**
+     * This constructor initializes the object.
+     *
+     * @param[in] aInstance      A reference to the OpenThread instance.
+     *
+     */
+    explicit SecureAgent(Instance &aInstance);
+
+private:
+    static bool HandleResource(CoapBase &              aCoapBase,
+                               const char *            aUriPath,
+                               Message &               aMessage,
+                               const Ip6::MessageInfo &aMessageInfo);
+    bool        HandleResource(const char *aUriPath, Message &aMessage, const Ip6::MessageInfo &aMessageInfo);
+};
+
+#endif
+
 } // namespace Tmf
 } // namespace ot