diff --git a/mon/antietcd_adapter.js b/mon/antietcd_adapter.js
index 9fe206be..6a3c4086 100644
--- a/mon/antietcd_adapter.js
+++ b/mon/antietcd_adapter.js
@@ -78,8 +78,7 @@ class AntiEtcdAdapter
                     delete antietcd_config.cluster;
                     delete antietcd_config.cluster_key;
                 }
-                const use_perms = config.use_perms || config.use_perms == null && config.client_ca;
-                if (use_perms)
+                if (config.use_perms)
                 {
                     antietcd_config.client_cert_auth = true;
                     antietcd_config.auth_filter = vitastor_auth_filter;
diff --git a/src/cmd/cli_serve.cpp b/src/cmd/cli_serve.cpp
index aee13ff4..4fa9c758 100644
--- a/src/cmd/cli_serve.cpp
+++ b/src/cmd/cli_serve.cpp
@@ -112,6 +112,7 @@ struct cli_serve_t
         listen_backlog = options["listen_backlog"].uint64_value();
         if (!listen_backlog)
             listen_backlog = 128;
+        use_perms = json_is_true(parent->cli->config["use_perms"]);
         {
             std::string tls_cert = (parent->cli->config.find("server_cert") != parent->cli->config.end()
                 ? parent->cli->config["server_cert"].string_value() : "");
@@ -128,10 +129,6 @@ struct cli_serve_t
                     state = 100;
                     return;
                 }
-                // use_perms is enabled by default when client_ca is set
-                use_perms = (parent->cli->config["use_perms"].is_null()
-                    ? (tls_ca != "")
-                    : json_is_true(parent->cli->config["use_perms"]));
                 std::string error;
                 http_ctx = http_context_init(parent->epmgr->tfd, tls_cert, tls_key, tls_ca, tls_ca != "", error);
                 if (error != "")
@@ -141,6 +138,12 @@ struct cli_serve_t
                     return;
                 }
             }
+            else if (use_perms)
+            {
+                result = (cli_result_t){ .err = EINVAL, .text = "use_perms requires encryption" };
+                state = 100;
+                return;
+            }
         }
         for (auto & bind_address: bind_addresses)
         {
diff --git a/src/osd/osd.cpp b/src/osd/osd.cpp
index 69f9b4a3..c13822de 100644
--- a/src/osd/osd.cpp
+++ b/src/osd/osd.cpp
@@ -178,7 +178,10 @@ void osd_t::parse_config(bool init)
         // OSD number
         osd_num = config["osd_num"].uint64_value();
         if (!osd_num)
-            throw std::runtime_error("osd_num is required in the configuration");
+        {
+            fprintf(stderr, "osd_num is required in the configuration\n");
+            exit(1);
+        }
         msgr.osd_num = osd_num;
         st_cli->osd_num = osd_num;
     }
@@ -191,10 +194,12 @@ void osd_t::parse_config(bool init)
     msgr.parse_config(config, init);
     if (init)
     {
-        // use_perms is enabled by default when encryption is enabled
-        use_perms = (config["use_perms"].is_null()
-            ? msgr.is_encryption_enabled()
-            : json_is_true(config["use_perms"]));
+        use_perms = json_is_true(config["use_perms"]);
+        if (use_perms && !msgr.is_encryption_enabled())
+        {
+            fprintf(stderr, "use_perms requires encryption\n");
+            exit(1);
+        }
         // Vital Blockstore parameters
         bs_block_size = config["block_size"].uint64_value();
         if (!bs_block_size)