diff --git a/src/ejabberd_c2s.erl b/src/ejabberd_c2s.erl
index a94d065fe..c33b366a6 100644
--- a/src/ejabberd_c2s.erl
+++ b/src/ejabberd_c2s.erl
@@ -940,8 +940,7 @@ transform_listen_option(Opt, Opts) ->
     [Opt|Opts].
 
 -type resource_conflict() :: setresource | closeold | closenew | acceptnew.
--spec opt_type(c2s_certfile) -> fun((binary()) -> binary());
-	      (c2s_ciphers) -> fun((binary()) -> binary());
+-spec opt_type(c2s_ciphers) -> fun((binary()) -> binary());
 	      (c2s_dhfile) -> fun((binary()) -> binary());
 	      (c2s_cafile) -> fun((binary()) -> binary());
 	      (c2s_protocol_options) -> fun(([binary()]) -> binary());
@@ -949,11 +948,6 @@ transform_listen_option(Opt, Opts) ->
 	      (resource_conflict) -> fun((resource_conflict()) -> resource_conflict());
 	      (disable_sasl_mechanisms) -> fun((binary() | [binary()]) -> [binary()]);
 	      (atom()) -> [atom()].
-opt_type(c2s_certfile = Opt) ->
-    fun(File) ->
-	    ?WARNING_MSG("option '~s' is deprecated, use 'certfiles' instead", [Opt]),
-	    misc:try_read_file(File)
-    end;
 opt_type(c2s_ciphers) -> fun iolist_to_binary/1;
 opt_type(c2s_dhfile) -> fun misc:try_read_file/1;
 opt_type(c2s_cafile) -> fun misc:try_read_file/1;
@@ -975,7 +969,7 @@ opt_type(disable_sasl_mechanisms) ->
 	(V) -> [str:to_upper(V)]
     end;
 opt_type(_) ->
-    [c2s_certfile, c2s_ciphers, c2s_cafile, c2s_dhfile,
+    [c2s_ciphers, c2s_cafile, c2s_dhfile,
      c2s_protocol_options, c2s_tls_compression, resource_conflict,
      disable_sasl_mechanisms].
 
diff --git a/src/ejabberd_config.erl b/src/ejabberd_config.erl
index 83e8df641..a40e16c34 100644
--- a/src/ejabberd_config.erl
+++ b/src/ejabberd_config.erl
@@ -1391,7 +1391,6 @@ now_to_seconds({MegaSecs, Secs, _MicroSecs}) ->
 	      (cache_size) -> fun((timeout()) -> timeout());
 	      (cache_missed) -> fun((boolean()) -> boolean());
 	      (cache_life_time) -> fun((timeout()) -> timeout());
-	      (domain_certfile) -> fun((binary()) -> binary());
 	      (shared_key) -> fun((binary()) -> binary());
 	      (node_start) -> fun((non_neg_integer()) -> non_neg_integer());
 	      (atom()) -> [atom()].
@@ -1429,11 +1428,6 @@ opt_type(cache_life_time) ->
        (infinity) -> infinity;
        (unlimited) -> infinity
     end;
-opt_type(domain_certfile = Opt) ->
-    fun(File) ->
-	    ?WARNING_MSG("option '~s' is deprecated, use 'certfiles' instead", [Opt]),
-	    misc:try_read_file(File)
-    end;
 opt_type(shared_key) ->
     fun iolist_to_binary/1;
 opt_type(node_start) ->
@@ -1442,7 +1436,7 @@ opt_type(_) ->
     [hide_sensitive_log_data, hosts, language, max_fsm_queue,
      default_db, default_ram_db, queue_type, queue_dir, loglevel,
      use_cache, cache_size, cache_missed, cache_life_time,
-     domain_certfile, shared_key, node_start].
+     shared_key, node_start].
 
 -spec may_hide_data(any()) -> any().
 may_hide_data(Data) ->
diff --git a/src/ejabberd_pkix.erl b/src/ejabberd_pkix.erl
index 37ec8b1cf..22d064903 100644
--- a/src/ejabberd_pkix.erl
+++ b/src/ejabberd_pkix.erl
@@ -151,8 +151,13 @@ opt_type(certfiles) ->
     fun(CertList) ->
 	    [binary_to_list(Path) || Path <- CertList]
     end;
+opt_type(O) when O == c2s_certfile; O == s2s_certfile; O == domain_certfile ->
+    fun(File) ->
+	    ?WARNING_MSG("option '~s' is deprecated, use 'certfiles' instead", [O]),
+	    misc:try_read_file(File)
+    end;
 opt_type(_) ->
-    [ca_path, certfiles].
+    [ca_path, certfiles, c2s_certfile, s2s_certfile, domain_certfile].
 
 %%%===================================================================
 %%% gen_server callbacks
diff --git a/src/ejabberd_s2s.erl b/src/ejabberd_s2s.erl
index 0626d62fb..1e389d712 100644
--- a/src/ejabberd_s2s.erl
+++ b/src/ejabberd_s2s.erl
@@ -703,7 +703,6 @@ get_s2s_state(S2sPid) ->
 -type use_starttls() :: boolean() | optional | required | required_trusted.
 -spec opt_type(route_subdomains) -> fun((s2s | local) -> s2s | local);
 	      (s2s_access) -> fun((any()) -> any());
-	      (s2s_certfile) -> fun((binary()) -> binary());
 	      (s2s_ciphers) -> fun((binary()) -> binary());
 	      (s2s_dhfile) -> fun((binary()) -> binary());
 	      (s2s_cafile) -> fun((binary()) -> binary());
@@ -720,11 +719,6 @@ opt_type(route_subdomains) ->
     end;
 opt_type(s2s_access) ->
     fun acl:access_rules_validator/1;
-opt_type(s2s_certfile = Opt) ->
-    fun(File) ->
-	    ?WARNING_MSG("option '~s' is deprecated, use 'certfiles' instead", [Opt]),
-	    misc:try_read_file(File)
-    end;
 opt_type(s2s_ciphers) -> fun iolist_to_binary/1;
 opt_type(s2s_dhfile) -> fun misc:try_read_file/1;
 opt_type(s2s_cafile) -> fun misc:try_read_file/1;
@@ -757,6 +751,6 @@ opt_type(s2s_timeout) ->
 opt_type(s2s_queue_type) ->
     fun(ram) -> ram; (file) -> file end;
 opt_type(_) ->
-    [route_subdomains, s2s_access,  s2s_certfile, s2s_zlib,
+    [route_subdomains, s2s_access, s2s_zlib,
      s2s_ciphers, s2s_dhfile, s2s_cafile, s2s_protocol_options,
      s2s_tls_compression, s2s_use_starttls, s2s_timeout, s2s_queue_type].