diff --git a/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfig.kt b/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfig.kt
index 6958721c..0fb7c3a6 100644
--- a/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfig.kt
+++ b/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfig.kt
@@ -67,11 +67,11 @@ class UpstreamsConfig {
     class EthereumConnection : UpstreamConnection() {
         var rpc: HttpEndpoint? = null
         var ws: WsEndpoint? = null
-        var auth: BasicAuth? = null
     }
 
     class HttpEndpoint(val url: URI) {
-        var auth: Auth? = null
+        var basicAuth: BasicAuth? = null
+        var tls: TlsAuth? = null
     }
 
     class WsEndpoint(val url: URI) {
@@ -87,11 +87,11 @@ class UpstreamsConfig {
             val password: String
     ) : Auth()
 
-    class TlsAuth : Auth() {
-        var ca: String? = null
-        var certificate: String? = null
+    class TlsAuth(
+        var ca: String? = null,
+        var certificate: String? = null,
         var key: String? = null
-    }
+    ) : Auth()
 
     //TODO make it unmodifiable after initial load
     class Labels: HashMap<String, String>() {
diff --git a/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfigReader.kt b/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfigReader.kt
index f9808179..a4041596 100644
--- a/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfigReader.kt
+++ b/src/main/kotlin/io/emeraldpay/dshackle/config/UpstreamsConfigReader.kt
@@ -49,10 +49,8 @@ class UpstreamsConfigReader {
                     getValueAsString(node, "url")?.let { url ->
                         val http = UpstreamsConfig.HttpEndpoint(URI(url))
                         connection.rpc = http
-                        http.auth = readAuth(getMapping(node, "auth"))
-                    }
-                    readAuth(getMapping(node, "auth"))?.let { auth ->
-                        connection.auth = auth as UpstreamsConfig.BasicAuth
+                        http.basicAuth = readBasicAuth(node)
+                        http.tls = readTls(node)
                     }
                 }
                 getMapping(connConfigNode, "ws")?.let { node ->
@@ -79,7 +77,7 @@ class UpstreamsConfigReader {
                 getValueAsInt(connConfigNode, "port")?.let {
                     connection.port = it
                 }
-                connection.auth = readAuth(getMapping(connConfigNode, "auth")) as UpstreamsConfig.TlsAuth?
+                connection.auth = readTls(connConfigNode)
             }
         }
 
@@ -137,34 +135,29 @@ class UpstreamsConfigReader {
         return options
     }
 
-    private fun readAuth(authNode: MappingNode?): UpstreamsConfig.Auth? {
-        return getValueAsString(authNode, "type")?.let {
-            return when (it) {
-                "tls" -> {
-                    val auth = UpstreamsConfig.TlsAuth()
-                    auth.ca = getValueAsString(authNode, "ca")
-                    auth.certificate = getValueAsString(authNode, "certificate")
-                    auth.key = getValueAsString(authNode, "key")
-                    auth
-                }
-                "basic" -> {
-                    val username = getValueAsString(authNode, "username")
-                    val password = getValueAsString(authNode, "password")
-                    if (username != null && password != null) {
-                        UpstreamsConfig.BasicAuth(username, password)
-                    } else {
-                        log.warn("Basic auth is not fully configured")
-                        null
-                    }
-                }
-                else -> {
-                    log.warn("Invalid Auth type: $it")
-                    null
-                }
+    private fun readBasicAuth(node: MappingNode?): UpstreamsConfig.BasicAuth? {
+        return getMapping(node, "basic-auth")?.let {  authNode ->
+            val username = getValueAsString(authNode, "username")
+            val password = getValueAsString(authNode, "password")
+            if (username != null && password != null) {
+                UpstreamsConfig.BasicAuth(username, password)
+            } else {
+                log.warn("Basic auth is not fully configured")
+                null
             }
         }
     }
 
+    private fun readTls(node: MappingNode?): UpstreamsConfig.TlsAuth? {
+        return getMapping(node, "tls")?.let { authNode ->
+            val auth = UpstreamsConfig.TlsAuth()
+            auth.ca = getValueAsString(authNode, "ca")
+            auth.certificate = getValueAsString(authNode, "certificate")
+            auth.key = getValueAsString(authNode, "key")
+            auth
+        }
+    }
+
     private fun hasAny(mappingNode: MappingNode?, key: String): Boolean {
         if (mappingNode == null) {
             return false
diff --git a/src/main/kotlin/io/emeraldpay/dshackle/upstream/ConfiguredUpstreams.kt b/src/main/kotlin/io/emeraldpay/dshackle/upstream/ConfiguredUpstreams.kt
index b575c479..f7295c94 100644
--- a/src/main/kotlin/io/emeraldpay/dshackle/upstream/ConfiguredUpstreams.kt
+++ b/src/main/kotlin/io/emeraldpay/dshackle/upstream/ConfiguredUpstreams.kt
@@ -14,7 +14,6 @@ import org.springframework.scheduling.annotation.Scheduled
 import org.springframework.stereotype.Repository
 import reactor.core.publisher.Flux
 import reactor.core.publisher.TopicProcessor
-import reactor.core.publisher.toFlux
 import java.io.File
 import java.net.URI
 import java.util.*
@@ -110,9 +109,14 @@ open class ConfiguredUpstreams(
         val urls = ArrayList<URI>()
         up.rpc?.let { endpoint ->
             val rpcTransport = DefaultRpcTransport(endpoint.url)
-            up.auth?.let { auth ->
+            up.rpc?.basicAuth?.let { auth ->
                 rpcTransport.setBasicAuth(auth.username, auth.password)
             }
+            up.rpc?.tls?.let { tls ->
+                tls.ca?.let { ca ->
+                    File(ca).inputStream().use { cert -> rpcTransport.setTrustedCertificate(cert) }
+                }
+            }
             val rpcClient = DefaultRpcClient(rpcTransport)
             rpcApi = EthereumApi(
                     rpcClient,
diff --git a/src/main/kotlin/io/emeraldpay/dshackle/upstream/UpstreamValidator.kt b/src/main/kotlin/io/emeraldpay/dshackle/upstream/UpstreamValidator.kt
index fc67cd63..193204ef 100644
--- a/src/main/kotlin/io/emeraldpay/dshackle/upstream/UpstreamValidator.kt
+++ b/src/main/kotlin/io/emeraldpay/dshackle/upstream/UpstreamValidator.kt
@@ -26,6 +26,7 @@ class UpstreamValidator(
             }
             return UpstreamAvailability.OK
         } catch (e: Throwable) {
+            e.printStackTrace()
             return UpstreamAvailability.UNAVAILABLE
         }
     }
diff --git a/src/test/groovy/io/emeraldpay/dshackle/config/UpstreamsConfigReaderSpec.groovy b/src/test/groovy/io/emeraldpay/dshackle/config/UpstreamsConfigReaderSpec.groovy
index 791a5f16..d9fad900 100644
--- a/src/test/groovy/io/emeraldpay/dshackle/config/UpstreamsConfigReaderSpec.groovy
+++ b/src/test/groovy/io/emeraldpay/dshackle/config/UpstreamsConfigReaderSpec.groovy
@@ -39,9 +39,8 @@ class UpstreamsConfigReaderSpec extends Specification {
             connection instanceof UpstreamsConfig.EthereumConnection
             with((UpstreamsConfig.EthereumConnection)connection) {
                 rpc.url == new URI("https://mainnet.infura.io/v3/fa28c968191849c1aff541ad1d8511f2")
-                rpc.auth != null
-                rpc.auth instanceof UpstreamsConfig.BasicAuth
-                with((UpstreamsConfig.BasicAuth)rpc.auth) {
+                rpc.basicAuth != null
+                with((UpstreamsConfig.BasicAuth)rpc.basicAuth) {
                     username == "4fc258fe41a68149c199ad8f281f2015"
                     password == "1a68f20154fc258fe4149c199ad8f281"
                 }
@@ -65,8 +64,8 @@ class UpstreamsConfigReaderSpec extends Specification {
             connection instanceof UpstreamsConfig.GrpcConnection
             with((UpstreamsConfig.GrpcConnection)connection) {
                 host == "10.2.0.15"
-                auth instanceof UpstreamsConfig.TlsAuth
-                with((UpstreamsConfig.TlsAuth)auth) {
+                auth != null
+                with(auth) {
                     ca == "/etc/ca.myservice.com.crt"
                     certificate == "/etc/client1.myservice.com.crt"
                     key == "/etc/client1.myservice.com.key"
diff --git a/src/test/resources/upstreams-basic.yaml b/src/test/resources/upstreams-basic.yaml
index 80960667..ce7a478c 100644
--- a/src/test/resources/upstreams-basic.yaml
+++ b/src/test/resources/upstreams-basic.yaml
@@ -22,7 +22,6 @@ upstreams:
       ethereum:
         rpc:
           url: "https://mainnet.infura.io/v3/fa28c968191849c1aff541ad1d8511f2"
-          auth:
-            type: basic
+          basic-auth:
             username: 4fc258fe41a68149c199ad8f281f2015
             password: 1a68f20154fc258fe4149c199ad8f281
\ No newline at end of file
diff --git a/src/test/resources/upstreams-ds.yaml b/src/test/resources/upstreams-ds.yaml
index 7e72cc94..640ec2a6 100644
--- a/src/test/resources/upstreams-ds.yaml
+++ b/src/test/resources/upstreams-ds.yaml
@@ -11,8 +11,7 @@ upstreams:
     connection:
       grpc:
         host: "10.2.0.15"
-        auth:
-          type: tls
+        tls:
           ca: /etc/ca.myservice.com.crt
           certificate: /etc/client1.myservice.com.crt
           key: /etc/client1.myservice.com.key
\ No newline at end of file
diff --git a/src/test/resources/upstreams-labels.yaml b/src/test/resources/upstreams-labels.yaml
index 049693ad..8523ae30 100644
--- a/src/test/resources/upstreams-labels.yaml
+++ b/src/test/resources/upstreams-labels.yaml
@@ -11,8 +11,7 @@ upstreams:
     connection:
       grpc:
         host: "10.2.0.15"
-        auth:
-          type: tls
+        tls:
           ca: /etc/ca.myservice.com.crt
           certificate: /etc/client1.myservice.com.crt
           key: /etc/client1.myservice.com.key
diff --git a/src/test/resources/upstreams-options.yaml b/src/test/resources/upstreams-options.yaml
index 4cc0b059..5cc61207 100644
--- a/src/test/resources/upstreams-options.yaml
+++ b/src/test/resources/upstreams-options.yaml
@@ -26,7 +26,6 @@ upstreams:
       ethereum:
         rpc:
           url: "https://mainnet.infura.io/v3/fa28c968191849c1aff541ad1d8511f2"
-          auth:
-            type: basic
+          basic-auth:
             username: 4fc258fe41a68149c199ad8f281f2015
             password: 1a68f20154fc258fe4149c199ad8f281
\ No newline at end of file