Revert "mortent/tls config from deploy params"

30 files changed, 46 insertions, 517 deletions

diff --git a/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java b/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java
index 136f30d437f..b5db9f5eddd 100644
--- a/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java
+++ b/config-model-api/src/main/java/com/yahoo/config/model/api/ModelContext.java
@@ -59,7 +59,6 @@ public interface ModelContext {
         boolean useAdaptiveDispatch();
         // TODO: Remove when 7.61 is the oldest model in use
         default boolean enableMetricsProxyContainer() { return false; }
-        Optional<TlsSecrets> tlsSecrets();
     }
 
 }
diff --git a/config-model-api/src/main/java/com/yahoo/config/model/api/TlsSecrets.java b/config-model-api/src/main/java/com/yahoo/config/model/api/TlsSecrets.java
deleted file mode 100644
index a066152aa0b..00000000000
--- a/config-model-api/src/main/java/com/yahoo/config/model/api/TlsSecrets.java
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2019 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
-package com.yahoo.config.model.api;
-
-public class TlsSecrets {
-    public static final TlsSecrets MISSING = new TlsSecrets();
-
-    private final String certificate;
-    private final String key;
-
-    private TlsSecrets() {
-        this(null,null);
-    }
-
-    public TlsSecrets(String certificate, String key) {
-        this.certificate = certificate;
-        this.key = key;
-    }
-
-    public String certificate() {
-        return certificate;
-    }
-
-    public String key() {
-        return key;
-    }
-
-    public boolean isMissing() {
-        return this == MISSING;
-    }
-}
diff --git a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
index 1892c8920a7..21a8297910f 100644
--- a/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
+++ b/config-model/src/main/java/com/yahoo/config/model/deploy/DeployState.java
@@ -15,7 +15,6 @@ import com.yahoo.config.model.api.ContainerEndpoint;
 import com.yahoo.config.model.api.HostProvisioner;
 import com.yahoo.config.model.api.Model;
 import com.yahoo.config.model.api.ModelContext;
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.model.api.ValidationParameters;
 import com.yahoo.config.model.application.provider.BaseDeployLogger;
 import com.yahoo.config.model.application.provider.MockFileRegistry;
@@ -257,8 +256,6 @@ public class DeployState implements ConfigDefinitionStore {
 
     public Instant now() { return now; }
 
-    public Optional<TlsSecrets> tlsSecrets() { return properties.tlsSecrets(); }
-
     public static class Builder {
 
         private ApplicationPackage applicationPackage = MockApplicationPackage.createEmpty();
@@ -276,7 +273,6 @@ public class DeployState implements ConfigDefinitionStore {
         private Zone zone = Zone.defaultZone();
         private Instant now = Instant.now();
         private Version wantedNodeVespaVersion = Vtag.currentVersion;
-        private Optional<TlsSecrets> tlsSecrets = Optional.empty();
 
         public Builder applicationPackage(ApplicationPackage applicationPackage) {
             this.applicationPackage = applicationPackage;
diff --git a/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java b/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java
index d974db73547..87ff9d1bb2a 100644
--- a/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java
+++ b/config-model/src/main/java/com/yahoo/config/model/deploy/TestProperties.java
@@ -5,7 +5,6 @@ import com.google.common.collect.ImmutableList;
 import com.yahoo.config.model.api.ConfigServerSpec;
 import com.yahoo.config.model.api.ContainerEndpoint;
 import com.yahoo.config.model.api.ModelContext;
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.HostName;
 import com.yahoo.config.provision.Rotation;
@@ -14,7 +13,6 @@ import com.yahoo.config.provision.Zone;
 import java.net.URI;
 import java.util.Collections;
 import java.util.List;
-import java.util.Optional;
 import java.util.Set;
 
 /**
@@ -41,7 +39,6 @@ public class TestProperties implements ModelContext.Properties {
     private boolean useFdispatchByDefault = true;
     private boolean dispatchWithProtobuf = true;
     private boolean useAdaptiveDispatch = false;
-    private Optional<TlsSecrets> tlsSecrets = Optional.empty();
 
 
     @Override public boolean multitenant() { return multitenant; }
@@ -61,7 +58,6 @@ public class TestProperties implements ModelContext.Properties {
     @Override public boolean useDedicatedNodeForLogserver() { return useDedicatedNodeForLogserver; }
     @Override public boolean useFdispatchByDefault() { return useFdispatchByDefault; }
     @Override public boolean dispatchWithProtobuf() { return dispatchWithProtobuf; }
-    @Override public Optional<TlsSecrets> tlsSecrets() { return tlsSecrets; }
 
     public TestProperties setApplicationId(ApplicationId applicationId) {
         this.applicationId = applicationId;
@@ -94,11 +90,6 @@ public class TestProperties implements ModelContext.Properties {
     }
 
 
-    public TestProperties setTlsSecrets(Optional<TlsSecrets> tlsSecrets) {
-        this.tlsSecrets = tlsSecrets;
-        return this;
-    }
-
     public static class Spec implements ConfigServerSpec {
 
         private final String hostName;
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainer.java b/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainer.java
index 48f7fa3c1a2..b381168838f 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainer.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainer.java
@@ -1,15 +1,8 @@
 // Copyright 2019 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.vespa.model.container;
 
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.model.api.container.ContainerServiceType;
 import com.yahoo.config.model.producer.AbstractConfigProducer;
-import com.yahoo.vespa.model.container.http.ConnectorFactory;
-import com.yahoo.vespa.model.container.http.Http;
-import com.yahoo.vespa.model.container.http.JettyHttpServer;
-import com.yahoo.vespa.model.container.http.ssl.ConfiguredDirectSslProvider;
-
-import java.util.Optional;
 
 /**
  * A container that is typically used by container clusters set up from the user application.
@@ -22,23 +15,14 @@ public final class ApplicationContainer extends Container {
 
     private final boolean isHostedVespa;
 
-    public ApplicationContainer(AbstractConfigProducer parent, String name, int index, boolean isHostedVespa, Optional<TlsSecrets> tlsSecrets) {
-        this(parent, name, false, index, isHostedVespa, tlsSecrets);
+
+    public ApplicationContainer(AbstractConfigProducer parent, String name, int index, boolean isHostedVespa) {
+        this(parent, name, false, index, isHostedVespa);
     }
 
-    public ApplicationContainer(AbstractConfigProducer parent, String name, boolean retired, int index, boolean isHostedVespa, Optional<TlsSecrets> tlsSecrets) {
+    public ApplicationContainer(AbstractConfigProducer parent, String name, boolean retired, int index, boolean isHostedVespa) {
         super(parent, name, retired, index);
         this.isHostedVespa = isHostedVespa;
-
-        if (isHostedVespa && tlsSecrets.isPresent()) {
-            String connectorName = "tls4443";
-
-            JettyHttpServer server = Optional.ofNullable(getHttp())
-                                             .map(Http::getHttpServer)
-                                             .orElse(getDefaultHttpServer());
-            server.addConnector(new ConnectorFactory(connectorName, 4443,
-                                                     new ConfiguredDirectSslProvider(server.getComponentId().getName(), tlsSecrets.get().key(), tlsSecrets.get().certificate(), null, null)));
-        }
     }
 
     @Override
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainerCluster.java b/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainerCluster.java
index 0f5ae6250ea..9cbaa5f91af 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainerCluster.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/ApplicationContainerCluster.java
@@ -4,7 +4,6 @@ package com.yahoo.vespa.model.container;
 import com.yahoo.component.ComponentId;
 import com.yahoo.config.FileReference;
 import com.yahoo.config.application.api.ComponentInfo;
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.model.deploy.DeployState;
 import com.yahoo.config.model.producer.AbstractConfigProducer;
 import com.yahoo.container.BundlesConfig;
@@ -23,7 +22,6 @@ import java.util.ArrayList;
 import java.util.Collection;
 import java.util.LinkedHashSet;
 import java.util.Map;
-import java.util.Optional;
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -47,12 +45,8 @@ public final class ApplicationContainerCluster extends ContainerCluster<Applicat
 
     private ContainerModelEvaluation modelEvaluation;
 
-    private Optional<TlsSecrets> tlsSecrets;
-
     public ApplicationContainerCluster(AbstractConfigProducer<?> parent, String subId, String name, DeployState deployState) {
         super(parent, subId, name, deployState);
-
-        this.tlsSecrets = deployState.tlsSecrets();
         restApiGroup = new ConfigProducerGroup<>(this, "rest-api");
         servletGroup = new ConfigProducerGroup<>(this, "servlet");
 
@@ -145,8 +139,4 @@ public final class ApplicationContainerCluster extends ContainerCluster<Applicat
         if (modelEvaluation != null) modelEvaluation.getConfig(builder);
     }
 
-    public Optional<TlsSecrets> getTlsSecrets() {
-        return tlsSecrets;
-    }
-
 }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/ConfiguredDirectSslProvider.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/ConfiguredDirectSslProvider.java
deleted file mode 100644
index 28dba3331d3..00000000000
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/ConfiguredDirectSslProvider.java
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright 2019 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
-package com.yahoo.vespa.model.container.http.ssl;
-
-import com.yahoo.component.ComponentId;
-import com.yahoo.container.bundle.BundleInstantiationSpecification;
-import com.yahoo.jdisc.http.ConnectorConfig;
-import com.yahoo.jdisc.http.ssl.impl.ConfiguredSslContextFactoryProvider;
-import com.yahoo.osgi.provider.model.ComponentModel;
-import com.yahoo.vespa.model.container.component.SimpleComponent;
-
-import java.util.Optional;
-
-import static com.yahoo.component.ComponentSpecification.fromString;
-
-/**
- * Configure SSL with PEM encoded certificate/key strings
- *
- * @author mortent
- * @author andreer
- */
-public class ConfiguredDirectSslProvider extends SimpleComponent implements ConnectorConfig.Producer {
-    public static final String COMPONENT_ID_PREFIX = "configured-ssl-provider@";
-    public static final String COMPONENT_CLASS = ConfiguredSslContextFactoryProvider.class.getName();
-    public static final String COMPONENT_BUNDLE = "jdisc_http_service";
-
-    private final String privateKey;
-    private final String certificate;
-    private final String caCertificatePath;
-    private final ConnectorConfig.Ssl.ClientAuth.Enum clientAuthentication;
-
-    public ConfiguredDirectSslProvider(String servername, String privateKey, String certificate, String caCertificatePath, String clientAuthentication) {
-        super(new ComponentModel(
-                new BundleInstantiationSpecification(new ComponentId(COMPONENT_ID_PREFIX+servername),
-                                                     fromString(COMPONENT_CLASS),
-                                                     fromString(COMPONENT_BUNDLE))));
-        this.privateKey = privateKey;
-        this.certificate = certificate;
-        this.caCertificatePath = caCertificatePath;
-        this.clientAuthentication = mapToConfigEnum(clientAuthentication);
-    }
-
-    @Override
-    public void getConfig(ConnectorConfig.Builder builder) {
-        builder.ssl.enabled(true);
-        builder.ssl.privateKey(privateKey);
-        builder.ssl.certificate(certificate);
-        builder.ssl.caCertificateFile(Optional.ofNullable(caCertificatePath).orElse(""));
-        builder.ssl.clientAuth(clientAuthentication);
-    }
-
-    public SimpleComponent getComponent() {
-        return new SimpleComponent(new ComponentModel(getComponentId().stringValue(), COMPONENT_CLASS, COMPONENT_BUNDLE));
-    }
-
-    private static ConnectorConfig.Ssl.ClientAuth.Enum mapToConfigEnum(String clientAuthValue) {
-        if ("disabled".equals(clientAuthValue)) {
-            return ConnectorConfig.Ssl.ClientAuth.Enum.DISABLED;
-        } else if ("want".equals(clientAuthValue)) {
-            return ConnectorConfig.Ssl.ClientAuth.Enum.WANT_AUTH;
-        } else if ("need".equals(clientAuthValue)) {
-            return ConnectorConfig.Ssl.ClientAuth.Enum.NEED_AUTH;
-        } else {
-            return ConnectorConfig.Ssl.ClientAuth.Enum.DISABLED;
-        }
-    }
-}
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/ConfiguredFilebasedSslProvider.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/ConfiguredSslProvider.java
index 4f84a01ff94..3c36933c030 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/ConfiguredFilebasedSslProvider.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/ssl/ConfiguredSslProvider.java
@@ -13,11 +13,9 @@ import java.util.Optional;
 import static com.yahoo.component.ComponentSpecification.fromString;
 
 /**
- * Configure SSL using file references
- *
  * @author mortent
  */
-public class ConfiguredFilebasedSslProvider extends SimpleComponent implements ConnectorConfig.Producer {
+public class ConfiguredSslProvider extends SimpleComponent implements ConnectorConfig.Producer {
     public static final String COMPONENT_ID_PREFIX = "configured-ssl-provider@";
     public static final String COMPONENT_CLASS = ConfiguredSslContextFactoryProvider.class.getName();
     public static final String COMPONENT_BUNDLE = "jdisc_http_service";
@@ -27,7 +25,7 @@ public class ConfiguredFilebasedSslProvider extends SimpleComponent implements C
     private final String caCertificatePath;
     private final ConnectorConfig.Ssl.ClientAuth.Enum clientAuthentication;
 
-    public ConfiguredFilebasedSslProvider(String servername, String privateKeyPath, String certificatePath, String caCertificatePath, String clientAuthentication) {
+    public ConfiguredSslProvider(String servername, String privateKeyPath, String certificatePath, String caCertificatePath, String clientAuthentication) {
         super(new ComponentModel(
                 new BundleInstantiationSpecification(new ComponentId(COMPONENT_ID_PREFIX+servername),
                                                      fromString(COMPONENT_CLASS),
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/JettyConnectorBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/JettyConnectorBuilder.java
index 1b457b1250a..23865eb9bdd 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/JettyConnectorBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/http/xml/JettyConnectorBuilder.java
@@ -9,7 +9,7 @@ import com.yahoo.vespa.model.builder.xml.dom.VespaDomBuilder;
 import com.yahoo.vespa.model.container.component.SimpleComponent;
 import com.yahoo.vespa.model.container.http.ConnectorFactory;
 import com.yahoo.vespa.model.container.http.ssl.CustomSslProvider;
-import com.yahoo.vespa.model.container.http.ssl.ConfiguredFilebasedSslProvider;
+import com.yahoo.vespa.model.container.http.ssl.ConfiguredSslProvider;
 import com.yahoo.vespa.model.container.http.ssl.DefaultSslProvider;
 import org.w3c.dom.Element;
 
@@ -39,7 +39,7 @@ public class JettyConnectorBuilder extends VespaDomBuilder.DomConfigProducerBuil
             String certificateFile = XML.getValue(XML.getChild(sslConfigurator, "certificate-file"));
             Optional<String> caCertificateFile = XmlHelper.getOptionalChildValue(sslConfigurator, "ca-certificates-file");
             Optional<String> clientAuthentication = XmlHelper.getOptionalChildValue(sslConfigurator, "client-authentication");
-            return new ConfiguredFilebasedSslProvider(
+            return new ConfiguredSslProvider(
                     serverName,
                     privateKeyFile,
                     certificateFile,
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
index 57e0b969929..f68ddecad9d 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerModelBuilder.java
@@ -431,7 +431,7 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
     }
 
     private void addStandaloneNode(ApplicationContainerCluster cluster) {
-        ApplicationContainer container =  new ApplicationContainer(cluster, "standalone", cluster.getContainers().size(), cluster.isHostedVespa(), cluster.getTlsSecrets());
+        ApplicationContainer container =  new ApplicationContainer(cluster, "standalone", cluster.getContainers().size(), cluster.isHostedVespa());
         cluster.addContainers(Collections.singleton(container));
     }
 
@@ -497,7 +497,7 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
         Element nodesElement = XML.getChild(containerElement, "nodes");
         Element rotationsElement = XML.getChild(containerElement, "rotations");
         if (nodesElement == null) { // default single node on localhost
-            ApplicationContainer node = new ApplicationContainer(cluster, "container.0", 0, cluster.isHostedVespa(), cluster.getTlsSecrets());
+            ApplicationContainer node = new ApplicationContainer(cluster, "container.0", 0, cluster.isHostedVespa());
             HostResource host = allocateSingleNodeHost(cluster, log, containerElement, context);
             node.setHostResource(host);
             node.initService(context.getDeployLogger());
@@ -686,7 +686,7 @@ public class ContainerModelBuilder extends ConfigModelBuilder<ContainerModel> {
         List<ApplicationContainer> nodes = new ArrayList<>();
         for (Map.Entry<HostResource, ClusterMembership> entry : hosts.entrySet()) {
             String id = "container." + entry.getValue().index();
-            ApplicationContainer container = new ApplicationContainer(cluster, id, entry.getValue().retired(), entry.getValue().index(), cluster.isHostedVespa(), cluster.getTlsSecrets());
+            ApplicationContainer container = new ApplicationContainer(cluster, id, entry.getValue().retired(), entry.getValue().index(), cluster.isHostedVespa());
             container.setHostResource(entry.getKey());
             container.initService(deployLogger);
             nodes.add(container);
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerServiceBuilder.java b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerServiceBuilder.java
index 46271d3c0a2..fd0797d6098 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerServiceBuilder.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/container/xml/ContainerServiceBuilder.java
@@ -22,7 +22,7 @@ public class ContainerServiceBuilder extends VespaDomBuilder.DomConfigProducerBu
 
     @Override
     protected ApplicationContainer doBuild(DeployState deployState, AbstractConfigProducer parent, Element nodeElem) {
-        return new ApplicationContainer(parent, id, index, deployState.isHosted(), deployState.tlsSecrets());
+        return new ApplicationContainer(parent, id, index, deployState.isHosted());
     }
 
 }
diff --git a/config-model/src/main/java/com/yahoo/vespa/model/content/Content.java b/config-model/src/main/java/com/yahoo/vespa/model/content/Content.java
index 8eda707be99..74caf2d8026 100644
--- a/config-model/src/main/java/com/yahoo/vespa/model/content/Content.java
+++ b/config-model/src/main/java/com/yahoo/vespa/model/content/Content.java
@@ -324,7 +324,7 @@ public class Content extends ConfigModel {
                 if (!processedHosts.contains(host)) {
                     String containerName = String.valueOf(searchNode.getDistributionKey());
                     ApplicationContainer docprocService = new ApplicationContainer(indexingCluster, containerName, index,
-                                                                                   modelContext.getDeployState().isHosted(), modelContext.getDeployState().tlsSecrets());
+                                                                                   modelContext.getDeployState().isHosted());
                     index++;
                     docprocService.useDynamicPorts();
                     docprocService.setHostResource(host);
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/ContainerClusterTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/ContainerClusterTest.java
index ac85a958ed5..ba7fbef439c 100755
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/ContainerClusterTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/ContainerClusterTest.java
@@ -5,7 +5,6 @@ import com.yahoo.cloud.config.ClusterInfoConfig;
 import com.yahoo.cloud.config.ConfigserverConfig;
 import com.yahoo.cloud.config.RoutingProviderConfig;
 import com.yahoo.config.application.api.DeployLogger;
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.model.deploy.DeployState;
 import com.yahoo.config.model.deploy.TestProperties;
 import com.yahoo.config.model.test.MockRoot;
@@ -14,7 +13,6 @@ import com.yahoo.config.provision.RegionName;
 import com.yahoo.config.provision.SystemName;
 import com.yahoo.config.provision.Zone;
 import com.yahoo.container.handler.ThreadpoolConfig;
-import com.yahoo.jdisc.http.ConnectorConfig;
 import com.yahoo.search.config.QrStartConfig;
 import com.yahoo.vespa.model.Host;
 import com.yahoo.vespa.model.HostResource;
@@ -22,22 +20,15 @@ import com.yahoo.vespa.model.admin.clustercontroller.ClusterControllerContainer;
 import com.yahoo.vespa.model.admin.clustercontroller.ClusterControllerContainerCluster;
 import com.yahoo.vespa.model.container.component.Component;
 import com.yahoo.vespa.model.container.docproc.ContainerDocproc;
-import com.yahoo.vespa.model.container.http.ConnectorFactory;
 import com.yahoo.vespa.model.container.search.ContainerSearch;
 import com.yahoo.vespa.model.container.search.searchchain.SearchChains;
-import org.hamcrest.Matchers;
 import org.junit.Test;
 
 import java.util.Collection;
 import java.util.Iterator;
-import java.util.List;
-import java.util.Optional;
-import java.util.stream.Collectors;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertThat;
-import static org.junit.Assert.assertTrue;
 
 /**
  * @author Simon Thoresen Hult
@@ -219,40 +210,9 @@ public class ContainerClusterTest {
         assertEquals(0, cluster.getAllComponents().stream().map(c -> c.getClassId().getName()).filter(c -> c.equals("com.yahoo.jdisc.http.filter.security.RoutingConfigProvider")).count());
     }
 
-    @Test
-    public void requireThatProvidingTlsSecretOpensPort4443() {
-        DeployState state = new DeployState.Builder().properties(new TestProperties().setHostedVespa(true).setTlsSecrets(Optional.of(new TlsSecrets("CERT", "KEY")))).build();
-        MockRoot root = new MockRoot("foo", state);
-        ApplicationContainerCluster cluster = new ApplicationContainerCluster(root, "container0", "container1", state);
-
-        addContainer(state.getDeployLogger(), cluster, "c1", "host-c1");
-        Optional<ApplicationContainer> container = cluster.getContainers().stream().findFirst();
-        assertTrue(container.isPresent());
-
-        var httpServer = (container.get().getHttp() == null) ? container.get().getDefaultHttpServer() : container.get().getHttp().getHttpServer();
-
-        // Verify that there are two connectors
-        List<ConnectorFactory> connectorFactories = httpServer.getConnectorFactories();
-        assertEquals(2, connectorFactories.size());
-        List<Integer> ports = connectorFactories.stream()
-                                                .map(ConnectorFactory::getListenPort)
-                                                .collect(Collectors.toList());
-        assertThat(ports, Matchers.containsInAnyOrder(8080, 4443));
-
-        ConnectorFactory tlsPort = connectorFactories.stream().filter(connectorFactory -> connectorFactory.getListenPort() == 4443).findFirst().orElseThrow();
-
-        ConnectorConfig.Builder builder = new ConnectorConfig.Builder();
-        tlsPort.getConfig(builder);
-
-        ConnectorConfig connectorConfig = new ConnectorConfig(builder);
-        assertTrue(connectorConfig.ssl().enabled());
-        assertEquals("CERT", connectorConfig.ssl().certificate());
-        assertEquals("KEY", connectorConfig.ssl().privateKey());
-        assertEquals(4443, connectorConfig.listenPort());
-    }
 
     private static void addContainer(DeployLogger deployLogger, ApplicationContainerCluster cluster, String name, String hostName) {
-        ApplicationContainer container = new ApplicationContainer(cluster, name, 0, cluster.isHostedVespa(), cluster.getTlsSecrets());
+        ApplicationContainer container = new ApplicationContainer(cluster, name, 0, cluster.isHostedVespa());
         container.setHostResource(new HostResource(new Host(null, hostName)));
         container.initService(deployLogger);
         cluster.addContainer(container);
diff --git a/config-model/src/test/java/com/yahoo/vespa/model/container/xml/JettyContainerModelBuilderTest.java b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/JettyContainerModelBuilderTest.java
index 880cccf02e4..03e115f0608 100644
--- a/config-model/src/test/java/com/yahoo/vespa/model/container/xml/JettyContainerModelBuilderTest.java
+++ b/config-model/src/test/java/com/yahoo/vespa/model/container/xml/JettyContainerModelBuilderTest.java
@@ -1,19 +1,16 @@
 // Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
 package com.yahoo.vespa.model.container.xml;
 
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.model.builder.xml.test.DomBuilderTest;
-import com.yahoo.config.model.deploy.DeployState;
-import com.yahoo.config.model.deploy.TestProperties;
 import com.yahoo.container.ComponentsConfig;
 import com.yahoo.container.jdisc.FilterBindingsProvider;
 import com.yahoo.jdisc.http.ConnectorConfig;
-import com.yahoo.vespa.model.container.ApplicationContainerCluster;
 import com.yahoo.vespa.model.container.ContainerCluster;
+import com.yahoo.vespa.model.container.ApplicationContainerCluster;
 import com.yahoo.vespa.model.container.component.SimpleComponent;
 import com.yahoo.vespa.model.container.http.ConnectorFactory;
 import com.yahoo.vespa.model.container.http.JettyHttpServer;
-import com.yahoo.vespa.model.container.http.ssl.ConfiguredFilebasedSslProvider;
+import com.yahoo.vespa.model.container.http.ssl.ConfiguredSslProvider;
 import org.junit.Test;
 import org.w3c.dom.Element;
 
@@ -24,7 +21,6 @@ import static org.hamcrest.CoreMatchers.equalTo;
 import static org.hamcrest.CoreMatchers.is;
 import static org.hamcrest.CoreMatchers.not;
 import static org.hamcrest.CoreMatchers.nullValue;
-import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 
@@ -178,7 +174,7 @@ public class JettyContainerModelBuilderTest extends ContainerModelBuilderTestBas
 
         ContainerCluster cluster = (ContainerCluster) root.getChildren().get("default");
         List<ConnectorFactory> connectorFactories = cluster.getChildrenByTypeRecursive(ConnectorFactory.class);
-        connectorFactories.forEach(connectorFactory -> assertChildComponentExists(connectorFactory, ConfiguredFilebasedSslProvider.COMPONENT_CLASS));
+        connectorFactories.forEach(connectorFactory -> assertChildComponentExists(connectorFactory, ConfiguredSslProvider.COMPONENT_CLASS));
     }
 
     @Test
@@ -226,37 +222,6 @@ public class JettyContainerModelBuilderTest extends ContainerModelBuilderTestBas
         assertTrue(sslProvider.ssl().enabled());
     }
 
-    @Test
-    public void verify_that_container_setup_additional_tls4443(){
-        Element clusterElem = DomBuilderTest.parse(
-                "<jdisc id='default' version='1.0' jetty='true'>",
-                "    <http>",
-                "        <server port='9000' id='ssl'>",
-                "            <ssl>",
-                "                <private-key-file>/foo/key</private-key-file>",
-                "                <certificate-file>/foo/cert</certificate-file>",
-                "            </ssl>",
-                "        </server>",
-                "    </http>",
-                nodesXml,
-                "",
-                "</jdisc>");
-
-        DeployState deployState = new DeployState.Builder().properties(new TestProperties().setHostedVespa(true).setTlsSecrets(Optional.of(new TlsSecrets("CERT", "KEY")))).build();
-        createModel(root, deployState, null, clusterElem);
-        ConnectorConfig sslProvider = root.getConfig(ConnectorConfig.class, "default/http/jdisc-jetty/ssl");
-        assertTrue(sslProvider.ssl().enabled());
-        assertEquals("", sslProvider.ssl().certificate());
-        assertEquals("", sslProvider.ssl().privateKey());
-
-        ConnectorConfig providedTls = root.getConfig(ConnectorConfig.class, "default/http/jdisc-jetty/tls4443");
-        assertTrue(providedTls.ssl().enabled());
-        assertEquals("CERT", providedTls.ssl().certificate());
-        assertEquals("KEY", providedTls.ssl().privateKey());
-        assertEquals(4443, providedTls.listenPort());
-
-    }
-
     private static void assertChildComponentExists(ConnectorFactory connectorFactory, String className) {
         Optional<SimpleComponent> simpleComponent = connectorFactory.getChildren().values().stream()
                 .map(z -> (SimpleComponent) z)
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/GlobalComponentRegistry.java b/configserver/src/main/java/com/yahoo/vespa/config/server/GlobalComponentRegistry.java
index 1eb18773898..d420c3f21fe 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/GlobalComponentRegistry.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/GlobalComponentRegistry.java
@@ -7,7 +7,6 @@ import com.yahoo.config.model.api.ConfigDefinitionRepo;
 import com.yahoo.config.provision.Provisioner;
 import com.yahoo.config.provision.TenantName;
 import com.yahoo.config.provision.Zone;
-import com.yahoo.container.jdisc.secretstore.SecretStore;
 import com.yahoo.vespa.config.server.application.PermanentApplicationPackage;
 import com.yahoo.vespa.config.server.host.HostRegistries;
 import com.yahoo.vespa.config.server.modelfactory.ModelFactoryRegistry;
@@ -47,5 +46,4 @@ public interface GlobalComponentRegistry {
     StripedExecutor<TenantName> getZkWatcherExecutor();
     FlagSource getFlagSource();
     ExecutorService getZkCacheExecutor();
-    SecretStore getSecretStore();
 }
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistry.java b/configserver/src/main/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistry.java
index 9badd19009f..ff76afd1c98 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistry.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistry.java
@@ -9,7 +9,6 @@ import com.yahoo.config.model.api.ConfigDefinitionRepo;
 import com.yahoo.config.provision.Provisioner;
 import com.yahoo.config.provision.TenantName;
 import com.yahoo.config.provision.Zone;
-import com.yahoo.container.jdisc.secretstore.SecretStore;
 import com.yahoo.vespa.config.server.application.PermanentApplicationPackage;
 import com.yahoo.vespa.config.server.host.HostRegistries;
 import com.yahoo.vespa.config.server.modelfactory.ModelFactoryRegistry;
@@ -49,7 +48,6 @@ public class InjectedGlobalComponentRegistry implements GlobalComponentRegistry
     private final Zone zone;
     private final ConfigServerDB configServerDB;
     private final FlagSource flagSource;
-    private final SecretStore secretStore;
     private final StripedExecutor<TenantName> zkWatcherExecutor;
     private final ExecutorService zkCacheExecutor;
 
@@ -69,8 +67,7 @@ public class InjectedGlobalComponentRegistry implements GlobalComponentRegistry
                                            HostProvisionerProvider hostProvisionerProvider,
                                            Zone zone,
                                            ConfigServerDB configServerDB,
-                                           FlagSource flagSource,
-                                           SecretStore secretStore) {
+                                           FlagSource flagSource) {
         this.curator = curator;
         this.configCurator = configCurator;
         this.metrics = metrics;
@@ -85,7 +82,6 @@ public class InjectedGlobalComponentRegistry implements GlobalComponentRegistry
         this.zone = zone;
         this.configServerDB = configServerDB;
         this.flagSource = flagSource;
-        this.secretStore = secretStore;
         this.zkWatcherExecutor = new StripedExecutor<>();
         this.zkCacheExecutor = Executors.newFixedThreadPool(1, ThreadFactoryFactory.getThreadFactory(TenantRepository.class.getName()));
     }
@@ -141,9 +137,4 @@ public class InjectedGlobalComponentRegistry implements GlobalComponentRegistry
     public ExecutorService getZkCacheExecutor() {
         return zkCacheExecutor;
     }
-
-    @Override
-    public SecretStore getSecretStore() {
-        return secretStore;
-    }
 }
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java b/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java
index d875385d14d..4627d350eb2 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/deploy/ModelContextImpl.java
@@ -11,7 +11,6 @@ import com.yahoo.config.model.api.ContainerEndpoint;
 import com.yahoo.config.model.api.HostProvisioner;
 import com.yahoo.config.model.api.Model;
 import com.yahoo.config.model.api.ModelContext;
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.HostName;
 import com.yahoo.config.provision.Rotation;
@@ -135,7 +134,6 @@ public class ModelContextImpl implements ModelContext {
         private final boolean useFdispatchByDefault;
         private final boolean useAdaptiveDispatch;
         private final boolean dispatchWithProtobuf;
-        private final Optional<TlsSecrets> tlsSecrets;
 
         public Properties(ApplicationId applicationId,
                           boolean multitenantFromConfig,
@@ -149,8 +147,7 @@ public class ModelContextImpl implements ModelContext {
                           Set<ContainerEndpoint> endpoints,
                           boolean isBootstrap,
                           boolean isFirstTimeDeployment,
-                          FlagSource flagSource,
-                          Optional<TlsSecrets> tlsSecrets) {
+                          FlagSource flagSource) {
             this.applicationId = applicationId;
             this.multitenant = multitenantFromConfig || hostedVespa || Boolean.getBoolean("multitenant");
             this.configServerSpecs = configServerSpecs;
@@ -171,7 +168,6 @@ public class ModelContextImpl implements ModelContext {
                     .with(FetchVector.Dimension.APPLICATION_ID, applicationId.serializedForm()).value();
             this.useAdaptiveDispatch = Flags.USE_ADAPTIVE_DISPATCH.bindTo(flagSource)
                     .with(FetchVector.Dimension.APPLICATION_ID, applicationId.serializedForm()).value();
-            this.tlsSecrets = tlsSecrets;
         }
 
         @Override
@@ -226,8 +222,6 @@ public class ModelContextImpl implements ModelContext {
         @Override
         public boolean useAdaptiveDispatch() { return useAdaptiveDispatch; }
 
-        @Override
-        public Optional<TlsSecrets> tlsSecrets() { return tlsSecrets; }
     }
 
 }
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java b/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java
index 94cd30de28b..117a9e0cac5 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/modelfactory/ActivatedModelsBuilder.java
@@ -13,7 +13,6 @@ import com.yahoo.config.provision.AllocatedHosts;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.HostName;
 import com.yahoo.config.provision.TenantName;
-import com.yahoo.container.jdisc.secretstore.SecretStore;
 import com.yahoo.log.LogLevel;
 import com.yahoo.vespa.config.server.ConfigServerSpec;
 import com.yahoo.vespa.config.server.GlobalComponentRegistry;
@@ -29,7 +28,6 @@ import com.yahoo.vespa.config.server.session.SilentDeployLogger;
 import com.yahoo.vespa.config.server.tenant.ContainerEndpointsCache;
 import com.yahoo.vespa.config.server.tenant.Rotations;
 import com.yahoo.vespa.config.server.tenant.TenantRepository;
-import com.yahoo.vespa.config.server.tenant.TlsSecretsKeys;
 import com.yahoo.vespa.curator.Curator;
 import com.yahoo.vespa.flags.FlagSource;
 
@@ -57,7 +55,6 @@ public class ActivatedModelsBuilder extends ModelsBuilder<Application> {
     private final Curator curator;
     private final DeployLogger logger;
     private final FlagSource flagSource;
-    private final SecretStore secretStore;
 
     public ActivatedModelsBuilder(TenantName tenant,
                                   long appGeneration,
@@ -76,7 +73,6 @@ public class ActivatedModelsBuilder extends ModelsBuilder<Application> {
         this.curator = globalComponentRegistry.getCurator();
         this.logger = new SilentDeployLogger();
         this.flagSource = globalComponentRegistry.getFlagSource();
-        this.secretStore = globalComponentRegistry.getSecretStore();
     }
 
     @Override
@@ -136,8 +132,7 @@ public class ActivatedModelsBuilder extends ModelsBuilder<Application> {
                                                ImmutableSet.copyOf(new ContainerEndpointsCache(TenantRepository.getTenantPath(tenant), curator).read(applicationId)),
                                                false, // We may be bootstrapping, but we only know and care during prepare
                                                false, // Always false, assume no one uses it when activating
-                                               flagSource,
-                                               new TlsSecretsKeys(curator, TenantRepository.getTenantPath(tenant), secretStore).readTlsSecretsKeyFromZookeeper(applicationId));
+                                               flagSource);
     }
 
 }
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/session/PrepareParams.java b/configserver/src/main/java/com/yahoo/vespa/config/server/session/PrepareParams.java
index 5bf70c55f9e..00a7625ee87 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/session/PrepareParams.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/session/PrepareParams.java
@@ -35,7 +35,6 @@ public final class PrepareParams {
     static final String VESPA_VERSION_PARAM_NAME = "vespaVersion";
     static final String ROTATIONS_PARAM_NAME = "rotations";
     static final String CONTAINER_ENDPOINTS_PARAM_NAME = "containerEndpoints";
-    static final String TLS_SECRETS_KEY_NAME_PARAM_NAME = "tlsSecretsKeyName";
 
     private final ApplicationId applicationId;
     private final TimeoutBudget timeoutBudget;
@@ -46,11 +45,10 @@ public final class PrepareParams {
     private final Optional<Version> vespaVersion;
     private final Set<Rotation> rotations;
     private final List<ContainerEndpoint> containerEndpoints;
-    private final Optional<String> tlsSecretsKeyName;
 
     private PrepareParams(ApplicationId applicationId, TimeoutBudget timeoutBudget, boolean ignoreValidationErrors,
-                          boolean dryRun, boolean verbose, boolean isBootstrap, Optional<Version> vespaVersion, Set<Rotation> rotations,
-			  List<ContainerEndpoint> containerEndpoints, Optional<String> tlsSecretsKeyName) {
+                          boolean dryRun, boolean verbose, boolean isBootstrap, Optional<Version> vespaVersion,
+                          Set<Rotation> rotations, List<ContainerEndpoint> containerEndpoints) {
         this.timeoutBudget = timeoutBudget;
         this.applicationId = applicationId;
         this.ignoreValidationErrors = ignoreValidationErrors;
@@ -63,7 +61,6 @@ public final class PrepareParams {
         if ((rotations != null && !rotations.isEmpty()) && !containerEndpoints.isEmpty()) {
             throw new IllegalArgumentException("Cannot set both rotations and containerEndpoints");
         }
-        this.tlsSecretsKeyName = tlsSecretsKeyName;
     }
 
     public static class Builder {
@@ -77,7 +74,6 @@ public final class PrepareParams {
         private Optional<Version> vespaVersion = Optional.empty();
         private Set<Rotation> rotations;
         private List<ContainerEndpoint> containerEndpoints = List.of();
-        private Optional<String> tlsSecretsKeyName = Optional.empty();
 
         public Builder() { }
 
@@ -140,18 +136,12 @@ public final class PrepareParams {
             if (serialized == null) return this;
             Slime slime = SlimeUtils.jsonToSlime(serialized);
             containerEndpoints = ContainerEndpointSerializer.endpointListFromSlime(slime);
-	    return this;
-	}
-
-        public Builder tlsSecretsKeyName(String tlsSecretsKeyName) {
-            this.tlsSecretsKeyName = Optional.ofNullable(tlsSecretsKeyName)
-                                           .filter(s -> ! s.isEmpty());
             return this;
         }
 
         public PrepareParams build() {
             return new PrepareParams(applicationId, timeoutBudget, ignoreValidationErrors, dryRun, 
-                                     verbose, isBootstrap, vespaVersion, rotations, containerEndpoints, tlsSecretsKeyName);
+                                     verbose, isBootstrap, vespaVersion, rotations, containerEndpoints);
         }
 
     }
@@ -165,7 +155,6 @@ public final class PrepareParams {
                             .vespaVersion(request.getProperty(VESPA_VERSION_PARAM_NAME))
                             .rotations(request.getProperty(ROTATIONS_PARAM_NAME))
                             .containerEndpoints(request.getProperty(CONTAINER_ENDPOINTS_PARAM_NAME))
-                            .tlsSecretsKeyName(request.getProperty(TLS_SECRETS_KEY_NAME_PARAM_NAME))
                             .build();
     }
 
@@ -223,7 +212,4 @@ public final class PrepareParams {
         return timeoutBudget;
     }
 
-    public Optional<String> tlsSecretsKeyName() {
-        return tlsSecretsKeyName;
-    }
 }
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java b/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java
index 54c96c0461d..30ba9989343 100644
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java
+++ b/configserver/src/main/java/com/yahoo/vespa/config/server/session/SessionPreparer.java
@@ -13,13 +13,11 @@ import com.yahoo.config.application.api.DeploymentSpec;
 import com.yahoo.config.application.api.FileRegistry;
 import com.yahoo.config.model.api.ConfigDefinitionRepo;
 import com.yahoo.config.model.api.ModelContext;
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.provision.AllocatedHosts;
 import com.yahoo.config.provision.ApplicationId;
 import com.yahoo.config.provision.HostName;
 import com.yahoo.config.provision.Rotation;
 import com.yahoo.config.provision.Zone;
-import com.yahoo.container.jdisc.secretstore.SecretStore;
 import com.yahoo.lang.SettableOptional;
 import com.yahoo.log.LogLevel;
 import com.yahoo.path.Path;
@@ -36,7 +34,6 @@ import com.yahoo.vespa.config.server.provision.HostProvisionerProvider;
 import com.yahoo.config.model.api.ContainerEndpoint;
 import com.yahoo.vespa.config.server.tenant.ContainerEndpointsCache;
 import com.yahoo.vespa.config.server.tenant.Rotations;
-import com.yahoo.vespa.config.server.tenant.TlsSecretsKeys;
 import com.yahoo.vespa.curator.Curator;
 import com.yahoo.vespa.flags.FlagSource;
 import org.xml.sax.SAXException;
@@ -72,7 +69,6 @@ public class SessionPreparer {
     private final Curator curator;
     private final Zone zone;
     private final FlagSource flagSource;
-    private final SecretStore secretStore;
 
     @Inject
     public SessionPreparer(ModelFactoryRegistry modelFactoryRegistry,
@@ -83,8 +79,7 @@ public class SessionPreparer {
                            ConfigDefinitionRepo configDefinitionRepo,
                            Curator curator,
                            Zone zone,
-                           FlagSource flagSource,
-                           SecretStore secretStore) {
+                           FlagSource flagSource) {
         this.modelFactoryRegistry = modelFactoryRegistry;
         this.fileDistributionFactory = fileDistributionFactory;
         this.hostProvisionerProvider = hostProvisionerProvider;
@@ -94,7 +89,6 @@ public class SessionPreparer {
         this.curator = curator;
         this.zone = zone;
         this.flagSource = flagSource;
-        this.secretStore = secretStore;
     }
 
     /**
@@ -118,7 +112,6 @@ public class SessionPreparer {
             if ( ! params.isDryRun()) {
                 preparation.writeStateZK();
                 preparation.writeRotZK();
-                preparation.writeTlsZK();
                 var globalServiceId = context.getApplicationPackage().getDeployment()
                                              .map(DeploymentSpec::fromXml)
                                              .flatMap(DeploymentSpec::globalServiceId);
@@ -152,8 +145,6 @@ public class SessionPreparer {
         final Set<Rotation> rotationsSet;
         final Set<ContainerEndpoint> endpointsSet;
         final ModelContext.Properties properties;
-        private final TlsSecretsKeys tlsSecretsKeys;
-        private final Optional<TlsSecrets> tlsSecrets;
 
         private ApplicationPackage applicationPackage;
         private List<PreparedModelsBuilder.PreparedModelResult> modelResultList;
@@ -174,10 +165,7 @@ public class SessionPreparer {
             this.rotations = new Rotations(curator, tenantPath);
             this.containerEndpoints = new ContainerEndpointsCache(tenantPath, curator);
             this.rotationsSet = getRotations(params.rotations());
-            this.tlsSecretsKeys = new TlsSecretsKeys(curator, tenantPath, secretStore);
-            this.tlsSecrets = tlsSecretsKeys.getTlsSecrets(params.tlsSecretsKeyName(), applicationId);
             this.endpointsSet = getEndpoints(params.containerEndpoints());
-
             this.properties = new ModelContextImpl.Properties(params.getApplicationId(),
                                                               configserverConfig.multitenant(),
                                                               ConfigServerSpec.fromConfig(configserverConfig),
@@ -190,8 +178,7 @@ public class SessionPreparer {
                                                               endpointsSet,
                                                               params.isBootstrap(),
                                                               ! currentActiveApplicationSet.isPresent(),
-                                                              context.getFlagSource(),
-                                                              tlsSecrets);
+                                                              context.getFlagSource());
             this.preparedModelsBuilder = new PreparedModelsBuilder(modelFactoryRegistry,
                                                                    permanentApplicationPackage,
                                                                    configDefinitionRepo,
@@ -251,11 +238,6 @@ public class SessionPreparer {
             checkTimeout("write rotations to zookeeper");
         }
 
-        void writeTlsZK() {
-            tlsSecretsKeys.writeTlsSecretsKeyToZooKeeper(applicationId, params.tlsSecretsKeyName().orElse(null));
-            checkTimeout("write tlsSecretsKey to zookeeper");
-        }
-
         void writeContainerEndpointsZK(Optional<String> globalServiceId) {
             if (!params.containerEndpoints().isEmpty()) { // Use endpoints from parameter when explicitly given
                 containerEndpoints.write(applicationId, params.containerEndpoints());
diff --git a/configserver/src/main/java/com/yahoo/vespa/config/server/tenant/TlsSecretsKeys.java b/configserver/src/main/java/com/yahoo/vespa/config/server/tenant/TlsSecretsKeys.java
deleted file mode 100644
index eaa4916d8fc..00000000000
--- a/configserver/src/main/java/com/yahoo/vespa/config/server/tenant/TlsSecretsKeys.java
+++ /dev/null
@@ -1,86 +0,0 @@
-// Copyright 2017 Yahoo Holdings. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
-package com.yahoo.vespa.config.server.tenant;
-
-import com.fasterxml.jackson.core.type.TypeReference;
-import com.fasterxml.jackson.databind.ObjectMapper;
-import com.yahoo.config.model.api.TlsSecrets;
-import com.yahoo.config.provision.ApplicationId;
-import com.yahoo.container.jdisc.secretstore.SecretStore;
-import com.yahoo.path.Path;
-import com.yahoo.vespa.curator.Curator;
-import com.yahoo.vespa.curator.transaction.CuratorOperations;
-import com.yahoo.vespa.curator.transaction.CuratorTransaction;
-
-import java.util.Optional;
-
-/**
- * TLS Secret keys for applications (used to retrieve actual certificate/key from secret store). Persisted in ZooKeeper.
- *
- * @author andreer
- */
-public class TlsSecretsKeys {
-
-    private final Path path;
-    private final SecretStore secretStore;
-    private final Curator curator;
-
-    public TlsSecretsKeys(Curator curator, Path tenantPath, SecretStore secretStore) {
-        this.curator = curator;
-        this.path = tenantPath.append("tlsSecretsKeys/");
-        this.secretStore = secretStore;
-    }
-
-    public Optional<TlsSecrets> readTlsSecretsKeyFromZookeeper(ApplicationId application) {
-        try {
-            Optional<byte[]> data = curator.getData(tlsSecretsKeyOf(application));
-            if (data.isEmpty() || data.get().length == 0) return Optional.empty();
-            String tlsSecretsKey = new ObjectMapper().readValue(data.get(), new TypeReference<String>() {});
-            return readFromSecretStore(Optional.ofNullable(tlsSecretsKey));
-        } catch (Exception e) {
-            throw new RuntimeException("Error reading TLS secret key of " + application, e);
-        }
-    }
-
-    public void writeTlsSecretsKeyToZooKeeper(ApplicationId application, String tlsSecretsKey) {
-        if (tlsSecretsKey == null) return;
-        try {
-            byte[] data = new ObjectMapper().writeValueAsBytes(tlsSecretsKey);
-            curator.set(tlsSecretsKeyOf(application), data);
-        } catch (Exception e) {
-            throw new RuntimeException("Could not write TLS secret key of " + application, e);
-        }
-    }
-
-    public Optional<TlsSecrets> getTlsSecrets(Optional<String> secretKeyname, ApplicationId applicationId) {
-        if (secretKeyname == null || secretKeyname.isEmpty()) {
-            return readTlsSecretsKeyFromZookeeper(applicationId);
-        }
-        return readFromSecretStore(secretKeyname);
-    }
-
-    private Optional<TlsSecrets> readFromSecretStore(Optional<String> secretKeyname) {
-        if(secretKeyname.isEmpty()) return Optional.empty();
-        TlsSecrets tlsSecretParameters = TlsSecrets.MISSING;
-        try {
-            String cert = secretStore.getSecret(secretKeyname.get() + "-cert");
-            String key = secretStore.getSecret(secretKeyname.get() + "-key");
-            tlsSecretParameters = new TlsSecrets(cert, key);
-        } catch (RuntimeException e) {
-            // Assume not ready yet
-//            log.log(LogLevel.DEBUG, "Could not fetch certificate/key with prefix: " + secretKeyname.get(), e);
-        }
-        return Optional.of(tlsSecretParameters);
-    }
-
-    /** Returns a transaction which deletes these tls secrets key if they exist */
-    public CuratorTransaction delete(ApplicationId application) {
-        if (!curator.exists(tlsSecretsKeyOf(application))) return CuratorTransaction.empty(curator);
-        return CuratorTransaction.from(CuratorOperations.delete(tlsSecretsKeyOf(application).getAbsolute()), curator);
-    }
-
-    /** Returns the path storing the tls secrets key for an application */
-    private Path tlsSecretsKeyOf(ApplicationId application) {
-        return path.append(application.serializedForm());
-    }
-
-}
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistryTest.java b/configserver/src/test/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistryTest.java
index e4ff8702ff1..9b113cae715 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistryTest.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/InjectedGlobalComponentRegistryTest.java
@@ -78,7 +78,7 @@ public class InjectedGlobalComponentRegistryTest {
         globalComponentRegistry =
                 new InjectedGlobalComponentRegistry(curator, configCurator, metrics, modelFactoryRegistry, sessionPreparer, rpcServer, configserverConfig,
                                                     generationCounter, defRepo, permanentApplicationPackage, hostRegistries, hostProvisionerProvider, zone,
-                                                    new ConfigServerDB(configserverConfig), new InMemoryFlagSource(), new MockSecretStore());
+                                                    new ConfigServerDB(configserverConfig), new InMemoryFlagSource());
     }
 
     @Test
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/MockSecretStore.java b/configserver/src/test/java/com/yahoo/vespa/config/server/MockSecretStore.java
deleted file mode 100644
index 8a77b53875e..00000000000
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/MockSecretStore.java
+++ /dev/null
@@ -1,35 +0,0 @@
-// Copyright 2019 Oath Inc. Licensed under the terms of the Apache 2.0 license. See LICENSE in the project root.
-package com.yahoo.vespa.config.server;
-
-import com.yahoo.container.jdisc.secretstore.SecretStore;
-
-import java.util.HashMap;
-import java.util.Map;
-
-public class MockSecretStore implements SecretStore {
-    Map<String, String> secrets = new HashMap<>();
-
-    @Override
-    public String getSecret(String key) {
-        if(secrets.containsKey(key))
-            return secrets.get(key);
-        throw new RuntimeException("Key not found: " + key);
-    }
-
-    @Override
-    public String getSecret(String key, int version) {
-        return getSecret(key);
-    }
-
-    public void put(String key, String value) {
-        secrets.put(key, value);
-    }
-
-    public void remove(String key) {
-        secrets.remove(key);
-    }
-
-    public void clear() {
-        secrets.clear();
-    }
-}
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java b/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java
index 860bbdc134c..b483705e3f5 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/ModelContextImplTest.java
@@ -62,8 +62,7 @@ public class ModelContextImplTest {
                         endpoints,
                         false,
                         false,
-                        flagSource,
-                        null),
+                        flagSource),
                 Optional.empty(),
                 new Version(6), 
                 new Version(6));
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/TestComponentRegistry.java b/configserver/src/test/java/com/yahoo/vespa/config/server/TestComponentRegistry.java
index a304f74858b..62685734a47 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/TestComponentRegistry.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/TestComponentRegistry.java
@@ -5,12 +5,12 @@ import com.google.common.io.Files;
 import com.yahoo.cloud.config.ConfigserverConfig;
 import com.yahoo.concurrent.InThreadExecutorService;
 import com.yahoo.concurrent.StripedExecutor;
+import com.yahoo.concurrent.ThreadFactoryFactory;
 import com.yahoo.config.model.NullConfigModelRegistry;
 import com.yahoo.config.model.api.ConfigDefinitionRepo;
 import com.yahoo.config.provision.Provisioner;
 import com.yahoo.config.provision.TenantName;
 import com.yahoo.config.provision.Zone;
-import com.yahoo.container.jdisc.secretstore.SecretStore;
 import com.yahoo.vespa.config.server.application.PermanentApplicationPackage;
 import com.yahoo.vespa.config.server.host.HostRegistries;
 import com.yahoo.vespa.config.server.modelfactory.ModelFactoryRegistry;
@@ -21,6 +21,7 @@ import com.yahoo.vespa.config.server.session.MockFileDistributionFactory;
 import com.yahoo.vespa.config.server.session.SessionPreparer;
 import com.yahoo.vespa.config.server.tenant.MockTenantListener;
 import com.yahoo.vespa.config.server.tenant.TenantListener;
+import com.yahoo.vespa.config.server.tenant.TenantRepository;
 import com.yahoo.vespa.config.server.tenant.TenantRequestHandlerTest;
 import com.yahoo.vespa.config.server.zookeeper.ConfigCurator;
 import com.yahoo.vespa.curator.Curator;
@@ -33,6 +34,7 @@ import java.time.Clock;
 import java.util.Collections;
 import java.util.Optional;
 import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
 
 
 /**
@@ -58,7 +60,6 @@ public class TestComponentRegistry implements GlobalComponentRegistry {
     private final ConfigServerDB configServerDB;
     private final StripedExecutor<TenantName> zkWatcherExecutor;
     private final ExecutorService zkCacheExecutor;
-    private final SecretStore secretStore;
 
     private TestComponentRegistry(Curator curator, ConfigCurator configCurator, Metrics metrics,
                                   ModelFactoryRegistry modelFactoryRegistry,
@@ -72,8 +73,7 @@ public class TestComponentRegistry implements GlobalComponentRegistry {
                                   ReloadListener reloadListener,
                                   TenantListener tenantListener,
                                   Zone zone,
-                                  Clock clock,
-                                  SecretStore secretStore) {
+                                  Clock clock) {
         this.curator = curator;
         this.configCurator = configCurator;
         this.metrics = metrics;
@@ -92,7 +92,6 @@ public class TestComponentRegistry implements GlobalComponentRegistry {
         this.configServerDB = new ConfigServerDB(configserverConfig);
         this.zkWatcherExecutor = new StripedExecutor<>(new InThreadExecutorService());
         this.zkCacheExecutor = new InThreadExecutorService();
-        this.secretStore = secretStore;
     }
 
     public static class Builder {
@@ -162,15 +161,14 @@ public class TestComponentRegistry implements GlobalComponentRegistry {
                     .orElse(new MockFileDistributionFactory(configserverConfig));
             HostProvisionerProvider hostProvisionerProvider = hostProvisioner.
                     map(HostProvisionerProvider::withProvisioner).orElseGet(HostProvisionerProvider::empty);
-            SecretStore secretStore = new MockSecretStore();
             SessionPreparer sessionPreparer = new SessionPreparer(modelFactoryRegistry, fileDistributionFactory,
                                                                   hostProvisionerProvider, permApp,
                                                                   configserverConfig, defRepo, curator,
-                                                                  zone, new InMemoryFlagSource(), secretStore);
+                                                                  zone, new InMemoryFlagSource());
             return new TestComponentRegistry(curator, ConfigCurator.create(curator), metrics, modelFactoryRegistry,
                                              permApp, fileDistributionFactory, hostRegistries, configserverConfig,
                                              sessionPreparer, hostProvisioner, defRepo, reloadListener, tenantListener,
-                                             zone, clock, secretStore);
+                                             zone, clock);
         }
     }
 
@@ -222,11 +220,6 @@ public class TestComponentRegistry implements GlobalComponentRegistry {
         return zkCacheExecutor;
     }
 
-    @Override
-    public SecretStore getSecretStore() {
-        return secretStore;
-    }
-
     public FileDistributionFactory getFileDistributionFactory() { return fileDistributionFactory; }
 
 }
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionPreparerTest.java b/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionPreparerTest.java
index 88baf1b8d74..74415993c52 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionPreparerTest.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionPreparerTest.java
@@ -4,7 +4,6 @@ package com.yahoo.vespa.config.server.session;
 import com.yahoo.component.Version;
 import com.yahoo.config.application.api.DeployLogger;
 import com.yahoo.config.model.api.ModelContext;
-import com.yahoo.config.model.api.TlsSecrets;
 import com.yahoo.config.model.application.provider.BaseDeployLogger;
 import com.yahoo.config.model.application.provider.FilesApplicationPackage;
 import com.yahoo.config.provision.ApplicationId;
@@ -17,7 +16,6 @@ import com.yahoo.log.LogLevel;
 import com.yahoo.path.Path;
 import com.yahoo.slime.Slime;
 import com.yahoo.vespa.config.server.MockReloadHandler;
-import com.yahoo.vespa.config.server.MockSecretStore;
 import com.yahoo.vespa.config.server.TestComponentRegistry;
 import com.yahoo.vespa.config.server.TimeoutBudgetTest;
 import com.yahoo.vespa.config.server.application.PermanentApplicationPackage;
@@ -31,7 +29,6 @@ import com.yahoo.vespa.config.server.provision.HostProvisionerProvider;
 import com.yahoo.config.model.api.ContainerEndpoint;
 import com.yahoo.vespa.config.server.tenant.ContainerEndpointsCache;
 import com.yahoo.vespa.config.server.tenant.Rotations;
-import com.yahoo.vespa.config.server.tenant.TlsSecretsKeys;
 import com.yahoo.vespa.config.server.zookeeper.ConfigCurator;
 import com.yahoo.vespa.curator.mock.MockCurator;
 import com.yahoo.vespa.flags.InMemoryFlagSource;
@@ -74,7 +71,7 @@ public class SessionPreparerTest {
     private SessionPreparer preparer;
     private TestComponentRegistry componentRegistry;
     private MockFileDistributionFactory fileDistributionFactory;
-    private MockSecretStore secretStore = new MockSecretStore();
+
 
     @Rule
     public TemporaryFolder folder = new TemporaryFolder();
@@ -109,8 +106,7 @@ public class SessionPreparerTest {
                 componentRegistry.getStaticConfigDefinitionRepo(),
                 curator,
                 componentRegistry.getZone(),
-                flagSource,
-                secretStore);
+                flagSource);
     }
 
     @Test(expected = InvalidApplicationException.class)
@@ -260,49 +256,6 @@ public class SessionPreparerTest {
         assertEquals(expected, readContainerEndpoints(applicationId));
     }
 
-    @Test
-    public void require_that_tlssecretkey_is_written() throws IOException {
-        var tlskey = "vespa.tlskeys.tenant1--app1";
-        var applicationId = applicationId("test");
-        var params = new PrepareParams.Builder().applicationId(applicationId).tlsSecretsKeyName(tlskey).build();
-        secretStore.put(tlskey+"-cert", "CERT");
-        secretStore.put(tlskey+"-key", "KEY");
-        prepare(new File("src/test/resources/deploy/hosted-app"), params);
-
-        // Read from zk and verify cert and key are available
-        Optional<TlsSecrets> tlsSecrets = new TlsSecretsKeys(curator, tenantPath, secretStore).readTlsSecretsKeyFromZookeeper(applicationId);
-        assertTrue(tlsSecrets.isPresent());
-        assertEquals("KEY", tlsSecrets.get().key());
-        assertEquals("CERT", tlsSecrets.get().certificate());
-    }
-
-    @Test
-    public void require_that_tlssecretkey_is_missing_when_not_in_secretstore() throws IOException {
-        var tlskey = "vespa.tlskeys.tenant1--app1";
-        var applicationId = applicationId("test");
-        var params = new PrepareParams.Builder().applicationId(applicationId).tlsSecretsKeyName(tlskey).build();
-        prepare(new File("src/test/resources/deploy/hosted-app"), params);
-
-        // Read from zk and verify key/cert is missing
-        Optional<TlsSecrets> tlsSecrets = new TlsSecretsKeys(curator, tenantPath, secretStore).readTlsSecretsKeyFromZookeeper(applicationId);
-        assertTrue(tlsSecrets.isPresent());
-        assertTrue(tlsSecrets.get().isMissing());
-    }
-
-    @Test
-    public void require_that_tlssecretkey_is_missing_when_certificate_not_in_secretstore() throws IOException {
-        var tlskey = "vespa.tlskeys.tenant1--app1";
-        var applicationId = applicationId("test");
-        var params = new PrepareParams.Builder().applicationId(applicationId).tlsSecretsKeyName(tlskey).build();
-        secretStore.put(tlskey+"-key", "KEY");
-        prepare(new File("src/test/resources/deploy/hosted-app"), params);
-
-        // Read from zk and verify key/cert is missing
-        Optional<TlsSecrets> tlsSecrets = new TlsSecretsKeys(curator, tenantPath, secretStore).readTlsSecretsKeyFromZookeeper(applicationId);
-        assertTrue(tlsSecrets.isPresent());
-        assertTrue(tlsSecrets.get().isMissing());
-    }
-
     private void prepare(File app) throws IOException {
         prepare(app, new PrepareParams.Builder().build());
     }
diff --git a/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionTest.java b/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionTest.java
index b2ad0af8f9a..95f6c7718e2 100644
--- a/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionTest.java
+++ b/configserver/src/test/java/com/yahoo/vespa/config/server/session/SessionTest.java
@@ -21,7 +21,7 @@ public class SessionTest {
         public boolean isPrepared = false;
 
         public MockSessionPreparer() {
-            super(null, null, null, null, null, null, new MockCurator(), null, null, null);
+            super(null, null, null, null, null, null, new MockCurator(), null, null);
         }
 
         @Override
diff --git a/jdisc_http_service/abi-spec.json b/jdisc_http_service/abi-spec.json
index a326b5792be..04e6d22a445 100644
--- a/jdisc_http_service/abi-spec.json
+++ b/jdisc_http_service/abi-spec.json
@@ -78,9 +78,7 @@
       "public void <init>(com.yahoo.jdisc.http.ConnectorConfig$Ssl)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder enabled(boolean)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder privateKeyFile(java.lang.String)",
-      "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder privateKey(java.lang.String)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder certificateFile(java.lang.String)",
-      "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder certificate(java.lang.String)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder caCertificateFile(java.lang.String)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder clientAuth(com.yahoo.jdisc.http.ConnectorConfig$Ssl$ClientAuth$Enum)",
       "public com.yahoo.jdisc.http.ConnectorConfig$Ssl build()"
@@ -133,9 +131,7 @@
       "public void <init>(com.yahoo.jdisc.http.ConnectorConfig$Ssl$Builder)",
       "public boolean enabled()",
       "public java.lang.String privateKeyFile()",
-      "public java.lang.String privateKey()",
       "public java.lang.String certificateFile()",
-      "public java.lang.String certificate()",
       "public java.lang.String caCertificateFile()",
       "public com.yahoo.jdisc.http.ConnectorConfig$Ssl$ClientAuth$Enum clientAuth()"
     ],
diff --git a/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/ConfiguredSslContextFactoryProvider.java b/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/ConfiguredSslContextFactoryProvider.java
index 2021105fc52..facb54bc37a 100644
--- a/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/ConfiguredSslContextFactoryProvider.java
+++ b/jdisc_http_service/src/main/java/com/yahoo/jdisc/http/ssl/impl/ConfiguredSslContextFactoryProvider.java
@@ -60,23 +60,15 @@ public class ConfiguredSslContextFactoryProvider implements SslContextFactoryPro
 
     private static void validateConfig(ConnectorConfig.Ssl config) {
         if (!config.enabled()) return;
+        if (config.certificateFile().isEmpty()) {
+            throw new IllegalArgumentException("Missing certificate file.");
+        }
+        if (config.privateKeyFile().isEmpty()) {
+            throw new IllegalArgumentException("Missing private key file.");
+        }
 
-        if(hasBoth(config.certificate(), config.certificateFile()))
-            throw new IllegalArgumentException("Specified both certificate and certificate file.");
-
-        if(hasBoth(config.privateKey(), config.privateKeyFile()))
-            throw new IllegalArgumentException("Specified both private key and private key file.");
-
-        if(hasNeither(config.certificate(), config.certificateFile()))
-            throw new IllegalArgumentException("Specified neither certificate or certificate file.");
-
-        if(hasNeither(config.privateKey(), config.privateKeyFile()))
-            throw new IllegalArgumentException("Specified neither private key or private key file.");
     }
 
-    private static boolean hasBoth(String a, String b) { return !a.isBlank() && !b.isBlank(); }
-    private static boolean hasNeither(String a, String b) { return a.isBlank() && b.isBlank(); }
-
     private static KeyStore createTruststore(ConnectorConfig.Ssl sslConfig) {
         List<X509Certificate> caCertificates = X509CertificateUtils.certificateListFromPem(readToString(sslConfig.caCertificateFile()));
         return KeyStoreBuilder.withType(KeyStoreType.JKS)
@@ -85,21 +77,11 @@ public class ConfiguredSslContextFactoryProvider implements SslContextFactoryPro
     }
 
     private static KeyStore createKeystore(ConnectorConfig.Ssl sslConfig) {
-        PrivateKey privateKey = KeyUtils.fromPemEncodedPrivateKey(getPrivateKey(sslConfig));
-        List<X509Certificate> certificates = X509CertificateUtils.certificateListFromPem(getCertificate(sslConfig));
+        PrivateKey privateKey = KeyUtils.fromPemEncodedPrivateKey(readToString(sslConfig.privateKeyFile()));
+        List<X509Certificate> certificates = X509CertificateUtils.certificateListFromPem(readToString(sslConfig.certificateFile()));
         return KeyStoreBuilder.withType(KeyStoreType.JKS).withKeyEntry("default", privateKey, certificates).build();
     }
 
-    private static String getPrivateKey(ConnectorConfig.Ssl config) {
-        if(!config.privateKey().isBlank()) return config.privateKey();
-        return readToString(config.privateKeyFile());
-    }
-
-    private static String getCertificate(ConnectorConfig.Ssl config) {
-        if(!config.certificate().isBlank()) return config.certificate();
-        return readToString(config.certificateFile());
-    }
-
     private static String readToString(String filename) {
         try {
             return Files.readString(Paths.get(filename), StandardCharsets.UTF_8);
diff --git a/jdisc_http_service/src/main/resources/configdefinitions/jdisc.http.connector.def b/jdisc_http_service/src/main/resources/configdefinitions/jdisc.http.connector.def
index c6c6fad345b..7735420d803 100644
--- a/jdisc_http_service/src/main/resources/configdefinitions/jdisc.http.connector.def
+++ b/jdisc_http_service/src/main/resources/configdefinitions/jdisc.http.connector.def
@@ -56,18 +56,12 @@ throttling.idleTimeout              double   default=-1.0
 # Whether to enable SSL for this connector.
 ssl.enabled                         bool     default=false
 
-# File with private key in PEM format. Specify either this or privateKey, but not both
+# File with private key in PEM format
 ssl.privateKeyFile                  string   default=""
 
-# Private key in PEM format. Specify either this or privateKeyFile, but not both
-ssl.privateKey                      string   default=""
-
-# File with certificate in PEM format. Specify either this or certificate, but not both
+# File with certificate in PEM format
 ssl.certificateFile                 string   default=""
 
-# Certificate in PEM format. Specify either this or certificateFile, but not both
-ssl.certificate                     string   default=""
-
 # with trusted CA certificates in PEM format. Used to verify clients
 ssl.caCertificateFile               string default=""