diff --git a/src/settings.js b/src/settings.js
index d1d40ce57..72f98d68b 100644
--- a/src/settings.js
+++ b/src/settings.js
@@ -24,9 +24,6 @@ exports = module.exports = {
     getBackupConfig: getBackupConfig,
     setBackupConfig: setBackupConfig,
 
-    getTlsConfig: getTlsConfig,
-    setTlsConfig: setTlsConfig,
-
     getCaasConfig: getCaasConfig,
 
     getAppstoreConfig: getAppstoreConfig,
@@ -43,7 +40,6 @@ exports = module.exports = {
 
     // json. if you add an entry here, be sure to fix getAll
     BACKUP_CONFIG_KEY: 'backup_config',
-    TLS_CONFIG_KEY: 'tls_config',
     UPDATE_CONFIG_KEY: 'update_config',
     APPSTORE_CONFIG_KEY: 'appstore_config',
     CAAS_CONFIG_KEY: 'caas_config',
@@ -83,7 +79,6 @@ var gDefaults = (function () {
         backupFolder: '/var/backups',
         retentionSecs: 172800
     };
-    result[exports.TLS_CONFIG_KEY] = { provider: 'letsencrypt-prod' };
     result[exports.UPDATE_CONFIG_KEY] = { prerelease: false };
     result[exports.APPSTORE_CONFIG_KEY] = {};
     result[exports.EMAIL_DIGEST] = true;
@@ -261,34 +256,6 @@ function setDynamicDnsConfig(enabled, callback) {
     });
 }
 
-function getTlsConfig(callback) {
-    assert.strictEqual(typeof callback, 'function');
-
-    settingsdb.get(exports.TLS_CONFIG_KEY, function (error, value) {
-        if (error && error.reason === DatabaseError.NOT_FOUND) return callback(null, gDefaults[exports.TLS_CONFIG_KEY]);
-        if (error) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
-
-        callback(null, JSON.parse(value)); // provider
-    });
-}
-
-function setTlsConfig(tlsConfig, callback) {
-    assert.strictEqual(typeof tlsConfig, 'object');
-    assert.strictEqual(typeof callback, 'function');
-
-    if (tlsConfig.provider !== 'fallback' && tlsConfig.provider !== 'caas' && tlsConfig.provider.indexOf('le-') !== 0) {
-        return callback(new SettingsError(SettingsError.BAD_FIELD, 'provider must be caas, fallback or le-*'));
-    }
-
-    settingsdb.set(exports.TLS_CONFIG_KEY, JSON.stringify(tlsConfig), function (error) {
-        if (error) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
-
-        exports.events.emit(exports.TLS_CONFIG_KEY, tlsConfig);
-
-        callback(null);
-    });
-}
-
 function getBackupConfig(callback) {
     assert.strictEqual(typeof callback, 'function');
 
@@ -441,7 +408,7 @@ function getAll(callback) {
         result[exports.DYNAMIC_DNS_KEY] = !!result[exports.DYNAMIC_DNS_KEY];
 
         // convert JSON objects
-        [exports.TLS_CONFIG_KEY, exports.BACKUP_CONFIG_KEY, exports.UPDATE_CONFIG_KEY, exports.APPSTORE_CONFIG_KEY ].forEach(function (key) {
+        [exports.BACKUP_CONFIG_KEY, exports.UPDATE_CONFIG_KEY, exports.APPSTORE_CONFIG_KEY ].forEach(function (key) {
             result[key] = typeof result[key] === 'object' ? result[key] : safe.JSON.parse(result[key]);
         });
 
diff --git a/src/setup.js b/src/setup.js
index c92881160..d9eb149e6 100644
--- a/src/setup.js
+++ b/src/setup.js
@@ -93,7 +93,6 @@ function autoprovision(callback) {
         switch (key) {
         case 'appstoreConfig': name = settings.APPSTORE_CONFIG_KEY; break;
         case 'caasConfig': name = settings.CAAS_CONFIG_KEY; break;
-        case 'tlsConfig': name = settings.TLS_CONFIG_KEY; break;
         case 'backupConfig': name = settings.BACKUP_CONFIG_KEY; break;
         case 'tlsCert':
             debug(`autoprovision: ${key}`);
diff --git a/src/test/settings-test.js b/src/test/settings-test.js
index c40adaef8..adf131e64 100644
--- a/src/test/settings-test.js
+++ b/src/test/settings-test.js
@@ -91,21 +91,6 @@ describe('Settings', function () {
             });
         });
 
-        it('can set tls config', function (done) {
-            settings.setTlsConfig({ provider: 'caas' }, function (error) {
-                expect(error).to.be(null);
-                done();
-            });
-        });
-
-        it('can get tls config', function (done) {
-            settings.getTlsConfig(function (error, dnsConfig) {
-                expect(error).to.be(null);
-                expect(dnsConfig.provider).to.be('caas');
-                done();
-            });
-        });
-
         it('can set backup config', function (done) {
             nock(config.apiServerOrigin())
                 .post(`/api/v1/boxes/${DOMAIN_0}/awscredentials?token=TOKEN`)