diff --git a/src/parser.cpp b/src/parser.cpp
index 5489175e..5d18c2d9 100644
--- a/src/parser.cpp
+++ b/src/parser.cpp
@@ -829,8 +829,13 @@ options_metadata parser::load_settings() THROWS
         "IP address to secure bind, multiple allowed, defaults to empty (disabled)."
     )
     (
-        "web.certificate_path",
-        value<std::filesystem::path>(&configured.server.web.certificate_path),
+        "web.cert_auth",
+        value<std::filesystem::path>(&configured.server.web.cert_auth),
+        "The certificate authority directory (*.PEM), enables client authentication."
+    )
+    (
+        "web.cert_path",
+        value<std::filesystem::path>(&configured.server.web.cert_path),
         "The path to the server certificate file (.PEM), defaults to unused."
     )
     (
@@ -839,8 +844,8 @@ options_metadata parser::load_settings() THROWS
         "The path to the server private key file (.PEM), defaults to unused."
     )
     (
-        "web.key_password",
-        value<std::string>(&configured.server.web.key_password),
+        "web.key_pass",
+        value<std::string>(&configured.server.web.key_pass),
         "The password to decrypt the server private key file (.PEM), optional."
     )
     (
@@ -911,8 +916,13 @@ options_metadata parser::load_settings() THROWS
         "IP address to secure bind, multiple allowed, defaults to empty (disabled)."
     )
     (
-        "explore.certificate_path",
-        value<std::filesystem::path>(&configured.server.explore.certificate_path),
+        "explore.cert_auth",
+        value<std::filesystem::path>(&configured.server.explore.cert_auth),
+        "The certificate authority directory (*.PEM), enables client authentication."
+    )
+    (
+        "explore.cert_path",
+        value<std::filesystem::path>(&configured.server.explore.cert_path),
         "The path to the server certificate file (.PEM), defaults to unused."
     )
     (
@@ -921,8 +931,8 @@ options_metadata parser::load_settings() THROWS
         "The path to the server private key file (.PEM), defaults to unused."
     )
     (
-        "explore.key_password",
-        value<std::string>(&configured.server.explore.key_password),
+        "explore.key_pass",
+        value<std::string>(&configured.server.explore.key_pass),
         "The password to decrypt the server private key file (.PEM), optional."
     )
     (
@@ -998,8 +1008,13 @@ options_metadata parser::load_settings() THROWS
         "IP address to secure bind, multiple allowed, defaults to empty (disabled)."
     )
     (
-        "bitcoind.certificate_path",
-        value<std::filesystem::path>(&configured.server.bitcoind.certificate_path),
+        "bitcoind.cert_auth",
+        value<std::filesystem::path>(&configured.server.bitcoind.cert_auth),
+        "The certificate authority directory (*.PEM), enables client authentication."
+    )
+    (
+        "bitcoind.cert_path",
+        value<std::filesystem::path>(&configured.server.bitcoind.cert_path),
         "The path to the server certificate file (.PEM), defaults to unused."
     )
     (
@@ -1008,8 +1023,8 @@ options_metadata parser::load_settings() THROWS
         "The path to the server private key file (.PEM), defaults to unused."
     )
     (
-        "bitcoind.key_password",
-        value<std::string>(&configured.server.bitcoind.key_password),
+        "bitcoind.key_pass",
+        value<std::string>(&configured.server.bitcoind.key_pass),
         "The password to decrypt the server private key file (.PEM), optional."
     )
     (
@@ -1070,8 +1085,8 @@ options_metadata parser::load_settings() THROWS
         "IP address to secure bind, multiple allowed, defaults to empty (disabled)."
     )
     (
-        "electrum.certificate_path",
-        value<std::filesystem::path>(&configured.server.electrum.certificate_path),
+        "electrum.cert_path",
+        value<std::filesystem::path>(&configured.server.electrum.cert_path),
         "The path to the server certificate file (.PEM), defaults to unused."
     )
     (
@@ -1117,8 +1132,8 @@ options_metadata parser::load_settings() THROWS
         "IP address to secure bind, multiple allowed, defaults to empty (disabled)."
     )
     (
-        "stratum_v1.certificate_path",
-        value<std::filesystem::path>(&configured.server.stratum_v1.certificate_path),
+        "stratum_v1.cert_path",
+        value<std::filesystem::path>(&configured.server.stratum_v1.cert_path),
         "The path to the server certificate file (.PEM), defaults to unused."
     )
     (
diff --git a/test/settings.cpp b/test/settings.cpp
index 2853eaa5..f7b10851 100644
--- a/test/settings.cpp
+++ b/test/settings.cpp
@@ -68,10 +68,10 @@ BOOST_AUTO_TEST_CASE(server__html_server__defaults__expected)
     // tls_server
     BOOST_REQUIRE(!instance.secure());
     BOOST_REQUIRE(instance.safes.empty());
-    BOOST_REQUIRE(instance.certificate_authority.empty());
-    BOOST_REQUIRE(instance.certificate_path.empty());
+    BOOST_REQUIRE(instance.cert_auth.empty());
+    BOOST_REQUIRE(instance.cert_path.empty());
     BOOST_REQUIRE(instance.key_path.empty());
-    BOOST_REQUIRE(instance.key_password.empty());
+    BOOST_REQUIRE(instance.key_pass.empty());
 
     // http_server
     BOOST_REQUIRE_EQUAL(instance.server, BC_HTTP_SERVER_NAME);
@@ -110,10 +110,10 @@ BOOST_AUTO_TEST_CASE(server__web_server__defaults__expected)
     // tls_server
     BOOST_REQUIRE(!server.secure());
     BOOST_REQUIRE(server.safes.empty());
-    BOOST_REQUIRE(server.certificate_authority.empty());
-    BOOST_REQUIRE(server.certificate_path.empty());
+    BOOST_REQUIRE(server.cert_auth.empty());
+    BOOST_REQUIRE(server.cert_path.empty());
     BOOST_REQUIRE(server.key_path.empty());
-    BOOST_REQUIRE(server.key_password.empty());
+    BOOST_REQUIRE(server.key_pass.empty());
 
     // http_server
     BOOST_REQUIRE_EQUAL(server.server, BC_HTTP_SERVER_NAME);
@@ -152,10 +152,10 @@ BOOST_AUTO_TEST_CASE(server__explore_server__defaults__expected)
     // tls_server
     BOOST_REQUIRE(!server.secure());
     BOOST_REQUIRE(server.safes.empty());
-    BOOST_REQUIRE(server.certificate_authority.empty());
-    BOOST_REQUIRE(server.certificate_path.empty());
+    BOOST_REQUIRE(server.cert_auth.empty());
+    BOOST_REQUIRE(server.cert_path.empty());
     BOOST_REQUIRE(server.key_path.empty());
-    BOOST_REQUIRE(server.key_password.empty());
+    BOOST_REQUIRE(server.key_pass.empty());
 
     // http_server
     BOOST_REQUIRE_EQUAL(server.server, BC_HTTP_SERVER_NAME);
@@ -195,10 +195,10 @@ BOOST_AUTO_TEST_CASE(server__bitcoind_server__defaults__expected)
     // tls_server
     BOOST_REQUIRE(!server.secure());
     BOOST_REQUIRE(server.safes.empty());
-    BOOST_REQUIRE(server.certificate_authority.empty());
-    BOOST_REQUIRE(server.certificate_path.empty());
+    BOOST_REQUIRE(server.cert_auth.empty());
+    BOOST_REQUIRE(server.cert_path.empty());
     BOOST_REQUIRE(server.key_path.empty());
-    BOOST_REQUIRE(server.key_password.empty());
+    BOOST_REQUIRE(server.key_pass.empty());
 
     // http_server
     BOOST_REQUIRE_EQUAL(server.server, BC_HTTP_SERVER_NAME);
@@ -226,10 +226,10 @@ BOOST_AUTO_TEST_CASE(server__electrum_server__defaults__expected)
     // tls_server
     BOOST_REQUIRE(!server.secure());
     BOOST_REQUIRE(server.safes.empty());
-    BOOST_REQUIRE(server.certificate_authority.empty());
-    BOOST_REQUIRE(server.certificate_path.empty());
+    BOOST_REQUIRE(server.cert_auth.empty());
+    BOOST_REQUIRE(server.cert_path.empty());
     BOOST_REQUIRE(server.key_path.empty());
-    BOOST_REQUIRE(server.key_password.empty());
+    BOOST_REQUIRE(server.key_pass.empty());
 }
 
 BOOST_AUTO_TEST_CASE(server__stratum_v1_server__defaults__expected)
@@ -252,10 +252,10 @@ BOOST_AUTO_TEST_CASE(server__stratum_v1_server__defaults__expected)
     // tls_server
     BOOST_REQUIRE(!server.secure());
     BOOST_REQUIRE(server.safes.empty());
-    BOOST_REQUIRE(server.certificate_authority.empty());
-    BOOST_REQUIRE(server.certificate_path.empty());
+    BOOST_REQUIRE(server.cert_auth.empty());
+    BOOST_REQUIRE(server.cert_path.empty());
     BOOST_REQUIRE(server.key_path.empty());
-    BOOST_REQUIRE(server.key_password.empty());
+    BOOST_REQUIRE(server.key_pass.empty());
 }
 
 BOOST_AUTO_TEST_CASE(server__stratum_v2_server__defaults__expected)