diff --git a/Makefile b/Makefile
index 18d18af..e370f4c 100644
--- a/Makefile
+++ b/Makefile
@@ -14,7 +14,7 @@ GIT_IS_TAG_COMMIT=$(shell git describe --abbrev=0 --tags > /dev/null 2> /dev/nul
 GIT_BRANCH=$(shell git rev-parse --abbrev-ref HEAD)
 
 # Build variables
-BUILD_VARS=-X main.GitCommit=${GIT_COMMIT} -X main.GitBranch=${GIT_BRANCH} -X main.BuildTime=${BUILD_TIME} -X main.GitClean=${GIT_CLEAN} -X main.LastGitTag=${LAST_GIT_TAG} -X main.GitTagIsCommit=${GIT_IS_TAG_COMMIT}
+BUILD_VARS=-s -w -X main.GitCommit=${GIT_COMMIT} -X main.GitBranch=${GIT_BRANCH} -X main.BuildTime=${BUILD_TIME} -X main.GitClean=${GIT_CLEAN} -X main.LastGitTag=${LAST_GIT_TAG} -X main.GitTagIsCommit=${GIT_IS_TAG_COMMIT}
 BUILD_FILES=glauth.go
 TRIM_FLAGS=-gcflags "all=-trimpath=${PWD}" -asmflags "all=-trimpath=${PWD}"
 
@@ -66,7 +66,7 @@ format:
 	go fmt
 
 devrun:
-	go run ${BUILD_FILES} -c glauth.cfg
+	go run ${BUILD_FILES} -c sample-simple.cfg
 
 
 linux32:
diff --git a/README.md b/README.md
index c1a3eb6..c8c9f73 100644
--- a/README.md
+++ b/README.md
@@ -28,12 +28,10 @@ This quickstart is a great way to try out GLAuth in a non-production environment
 1. Download a precompiled binary from the [releases](https://github.com/glauth/glauth/releases) page.
 2. Download the [example config file](https://github.com/glauth/glauth/blob/master/sample-simple.cfg).
 3. Start the GLAuth server, referencing the path to the desired config file with `-c`.
-   - `sudo ./glauth64 -c sample-simple.cfg`
+   - `./glauth64 -c sample-simple.cfg`
 4. Test with traditional LDAP tools
    - For example: `ldapsearch -LLL -H ldap://localhost:3893 -D cn=serviceuser,ou=svcaccts,dc=glauth,dc=com -w mysecret -x -bdc=glauth,dc=com cn=hackers`
 
-
-
 ### Make Commands
 
 Note - makefile uses git data to inject build-time variables. For best results, run in the context of the git repo.
@@ -60,6 +58,10 @@ Options:
   -K <aws_key_id>           AWS Key ID.
   -S <aws_secret_key>       AWS Secret Key.
   -r <aws_region>           AWS Region [default: us-east-1].
+  --ldap <address>          Listen address for the LDAP server.
+  --ldaps <address>         Listen address for the LDAPS server.
+  --ldaps-cert <cert-file>  Path to cert file for the LDAPS server.
+  --ldaps-key <key-file>    Path to key file for the LDAPS server.
   -h, --help                Show this screen.
   --version                 Show version.
 ```
@@ -213,7 +215,7 @@ make all
   - 8 trace
   - 10 I would like to performance test your log collection stack
 - errors really are errors that cannot be handled or returned
-  - returning a proper ldep error code is handling an error
+  - returning a proper LDAP error code is handling an error
 
 
 ## Stargazers over time
diff --git a/glauth.go b/glauth.go
index 38a591f..71dadc8 100644
--- a/glauth.go
+++ b/glauth.go
@@ -5,7 +5,6 @@ import (
 	"os"
 	"strings"
 
-	"github.com/BurntSushi/toml"
 	"github.com/GeertJohan/yubigo"
 	docopt "github.com/docopt/docopt-go"
 	"github.com/fsnotify/fsnotify"
@@ -15,10 +14,11 @@ import (
 	"github.com/glauth/glauth/pkg/server"
 	"github.com/glauth/glauth/pkg/stats"
 	"github.com/go-logr/logr"
+	"github.com/hydronica/toml"
 	"github.com/jinzhu/copier"
 	logging "github.com/op/go-logging"
-	"gopkg.in/amz.v1/aws"
-	"gopkg.in/amz.v1/s3"
+	"gopkg.in/amz.v3/aws"
+	"gopkg.in/amz.v3/s3"
 )
 
 // Set with buildtime vars
@@ -260,7 +260,10 @@ func parseConfigFile(configFileLocation string) (*config.Config, error) {
 		if len(parts) != 2 {
 			return &cfg, fmt.Errorf("Invalid S3 URL: %s", s3url)
 		}
-		b := s3.New(auth, region).Bucket(parts[0])
+		b, err := s3.New(auth, region).Bucket(parts[0])
+		if err != nil {
+			return &cfg, err
+		}
 		tomlData, err := b.Get(parts[1])
 		if err != nil {
 			return &cfg, err
@@ -277,7 +280,7 @@ func parseConfigFile(configFileLocation string) (*config.Config, error) {
 	return &cfg, nil
 }
 
-func handleConfig(cfg config.Config) (*config.Config, error) {
+func handleArgs(cfg config.Config) (*config.Config, error) {
 	// LDAP flags
 	if ldap, ok := args["--ldap"].(string); ok && ldap != "" {
 		cfg.LDAP.Enabled = true
@@ -296,6 +299,10 @@ func handleConfig(cfg config.Config) (*config.Config, error) {
 		cfg.LDAPS.Key = ldapsKey
 	}
 
+	return &cfg, nil
+}
+
+func handleLegacyConfig(cfg config.Config) (*config.Config, error) {
 	if len(cfg.Frontend.Listen) > 0 && (len(cfg.LDAP.Listen) > 0 || len(cfg.LDAPS.Listen) > 0) {
 		// Both old server-config and new - dont allow
 		return &cfg, fmt.Errorf("Both old and new server-config in use - please remove old format ([frontend]) and migrate to new format ([ldap], [ldaps])")
@@ -321,6 +328,9 @@ func handleConfig(cfg config.Config) (*config.Config, error) {
 			cfg.LDAPS.Key = cfg.Frontend.Key
 		}
 	}
+	return &cfg, nil
+}
+func validateConfig(cfg config.Config) (*config.Config, error) {
 
 	if !cfg.LDAP.Enabled && !cfg.LDAPS.Enabled {
 		return &cfg, fmt.Errorf("No server configuration found: please provide either LDAP or LDAPS configuration")
@@ -364,8 +374,19 @@ func doConfig() error {
 		return err
 	}
 
-	// Handle validation and parsing of old [frontend] section into [ldap] and/or [ldaps] sections
-	cfg, err = handleConfig(*cfg)
+	// Handle parsed flags
+	cfg, err = handleArgs(*cfg)
+	if err != nil {
+		return err
+	}
+
+	// Handle parsing of legacy [frontend] section into [ldap] and/or [ldaps] sections
+	cfg, err = handleLegacyConfig(*cfg)
+	if err != nil {
+		return err
+	}
+
+	cfg, err = validateConfig(*cfg)
 	if err != nil {
 		return err
 	}
diff --git a/go.mod b/go.mod
index c33c2d4..cf8cf98 100644
--- a/go.mod
+++ b/go.mod
@@ -1,22 +1,20 @@
 module github.com/glauth/glauth
 
-go 1.13
+go 1.15
 
 require (
-	github.com/BurntSushi/toml v0.3.1
 	github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e
+	github.com/boombuler/barcode v1.0.1 // indirect
 	github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815
-	github.com/fsnotify/fsnotify v1.4.7
-	github.com/go-logr/logr v0.1.0
+	github.com/fsnotify/fsnotify v1.4.9
+	github.com/go-logr/logr v0.4.0
+	github.com/hydronica/toml v0.4.2
 	github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a
-	github.com/jteeuwen/go-bindata v3.0.7+incompatible // indirect
-	github.com/kr/pretty v0.2.0 // indirect
 	github.com/nmcclain/asn1-ber v0.0.0-20170104154839-2661553a0484 // indirect
 	github.com/nmcclain/ldap v0.0.0-20191021200707-3b3b69a7e9e3
 	github.com/op/go-logging v0.0.0-20160315200505-970db520ece7
-	github.com/pquerna/otp v1.2.0
+	github.com/pquerna/otp v1.3.0
 	github.com/yaegashi/msgraph.go v0.1.1-0.20200221123608-2d438cf2a7cc
-	golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c // indirect
-	gopkg.in/amz.v1 v1.0.0-20150111123259-ad23e96a31d2
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
 )
diff --git a/go.sum b/go.sum
index 1ae2e68..0c81e47 100644
--- a/go.sum
+++ b/go.sum
@@ -1,26 +1,26 @@
 cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1 h1:WXkYYl6Yr3qBf1K79EBnL4mak0OimBfB0XUf9Vl28OQ=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
 github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e h1:Bqtt5C+uVk+vH/t5dmB47uDCTwxw16EYHqvJnmY2aQc=
 github.com/GeertJohan/yubigo v0.0.0-20190917122436-175bc097e60e/go.mod h1:njRCDrl+1RQ/A/+KVU8Ho2EWAxUSkohOWczdW3dzDG0=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc h1:biVzkmvwrH8WK8raXaxBx6fRVTlJILwEwQGL1I/ByEI=
 github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
+github.com/boombuler/barcode v1.0.1 h1:NDBbPmhS+EqABEs5Kg3n/5ZNjy73Pz7SIV+KCeqyXcs=
+github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
 github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=
-github.com/fsnotify/fsnotify v1.4.7 h1:IXs+QLmnXW2CcXuY+8Mzv/fWEsPGWxqefPtCP5CnV9I=
-github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
-github.com/go-logr/logr v0.1.0 h1:M1Tv3VzNlEHg6uyACnRdtrploV2P7wZqH8BoQMtz0cg=
-github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
+github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
+github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
+github.com/go-logr/logr v0.4.0 h1:K7/B1jt6fIBQVd4Owv2MqGQClcgf0R266+7C/QjRcLc=
+github.com/go-logr/logr v0.4.0/go.mod h1:z6/tIYblkpsD+a4lm/fGIIU9mZ+XfAiaFtq7xTgseGU=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/hydronica/toml v0.4.2 h1:BY+iAvyl2u1BlfgkJQzqc1UXDGLWfpMmOWuqJrwAVDU=
+github.com/hydronica/toml v0.4.2/go.mod h1:c7QhbYq3Wp9SlOWuG7MAieKUyXP2P/hXhy/YqWfbS/4=
 github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a h1:zPPuIq2jAWWPTrGt70eK/BSch+gFAGrNzecsoENgu2o=
 github.com/jinzhu/copier v0.0.0-20190924061706-b57f9002281a/go.mod h1:yL958EeXv8Ylng6IfnvG4oflryUi3vgA3xPs9hmII1s=
-github.com/jteeuwen/go-bindata v3.0.7+incompatible h1:91Uy4d9SYVr1kyTJ15wJsog+esAZZl7JmEfTkwmhJts=
-github.com/jteeuwen/go-bindata v3.0.7+incompatible/go.mod h1:JVvhzYOiGBnFSYRyV00iY8q7/0PThjIYav1p9h5dmKs=
-github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.2.1 h1:Fmg33tUaq4/8ym9TJN1x7sLJnHVwhP33CNkpYV/7rwI=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
 github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
@@ -32,8 +32,8 @@ github.com/op/go-logging v0.0.0-20160315200505-970db520ece7 h1:lDH9UUVJtmYCjyT0C
 github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pquerna/otp v1.2.0 h1:/A3+Jn+cagqayeR3iHs/L62m5ue7710D35zl1zJ1kok=
-github.com/pquerna/otp v1.2.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
+github.com/pquerna/otp v1.3.0 h1:oJV/SkzR33anKXwQU3Of42rL4wbrffP4uvUf1SvS5Xs=
+github.com/pquerna/otp v1.3.0/go.mod h1:dkJfzwRKNiegxyNb54X/3fLwhCynbMspSyWKnvi1AEg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.3.0 h1:TivCn/peBQ7UY8ooIcPgZFpTNSz0Q2U6UrFlUfqbe0Q=
 github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
@@ -44,11 +44,11 @@ golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73r
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45 h1:SVwTIAaPC2U/AvvLNZ2a7OVsmBpC8L5BlwK1whH3hm0=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c h1:jceGD5YNJGgGMkJz79agzOln1K9TaZUjv5ird16qniQ=
-golang.org/x/sys v0.0.0-20200219091948-cb0a6d8edb6c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9 h1:L2auWcuQIvxz9xSEqzESnV/QN/gNRXNApHi3fYwl2w0=
+golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-gopkg.in/amz.v1 v1.0.0-20150111123259-ad23e96a31d2 h1:FMrsB0OTjHsPDA1NM7AhRmmZzkBPu3iGdxK/5MFfBmk=
-gopkg.in/amz.v1 v1.0.0-20150111123259-ad23e96a31d2/go.mod h1:F0YaN4yi2XekmElKkPYfybh7pReQE9Ph48lSgeCkzyc=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b h1:tdSyAzD5FHJmZAZ13d5WexAo7YJkiyGphhzFfInMnDw=
+gopkg.in/amz.v3 v3.0.0-20201001071545-24fc1eceb27b/go.mod h1:cE0dCGx2UfBTjLFlzEx4EXJUmoX6BXBoX9GjKOvqha4=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
diff --git a/sample-ldap.cfg b/sample-ldap.cfg
index 5cfb5dd..8e782bc 100644
--- a/sample-ldap.cfg
+++ b/sample-ldap.cfg
@@ -7,12 +7,16 @@
 syslog = true
 
 #################
-# The frontend section controls how clients connect to the proxy.
-[frontend]
-  tls = true
+# Server configuration.
+[ldap]
+  enabled = true
+  listen = "0.0.0.0:389"
+
+[ldaps]
+  enabled = true
   listen = "0.0.0.0:636"
-  cert = "cert.pem"
-  key = "key.pem"
+  cert = "glauth.crt"
+  key = "glauth.key"
 
 #################
 # The backend section controls the data store.
@@ -29,6 +33,6 @@ syslog = true
   enabled = true
   tls = true
   listen = "localhost:5555"
-  cert = "cert.pem"
-  key = "key.pem"
+  cert = "glauth.crt"
+  key = "glauth.key"
 
diff --git a/sample-simple.cfg b/sample-simple.cfg
index 304ebc3..3e7a00f 100644
--- a/sample-simple.cfg
+++ b/sample-simple.cfg
@@ -16,26 +16,18 @@ debug = true
 
 #################
 # Server configuration.
-#
-# This is the old server-config format 
-# - will still work, but please use new format, shown below
-#
-# [frontend]
-#   listen = "localhost:8484"
-#   tls = false
-#   cert ="certs/server.crt"
-#   key = "certs/server.key"
-
-# This ([ldap] and [ldaps]) is the new server-config format
 [ldap]
   enabled = true
+  # run on a non privileged port
   listen = "0.0.0.0:3893"
 
 [ldaps]
-  enabled = true
+# to enable ldaps genrerate a certificate, eg. with:
+# openssl req -x509 -newkey rsa:4096 -keyout glauth.key -out glauth.crt -days 365 -nodes -subj '/CN=`hostname`'
+  enabled = false
   listen = "0.0.0.0:3894"
-  cert = "certs/server.crt"
-  key = "certs/server.key"
+  cert = "glauth.crt"
+  key = "glauth.key"
 
 #################
 # The backend section controls the data store.
diff --git a/scripts/docker/default-config.cfg b/scripts/docker/default-config.cfg
index 2b08bf8..68bb380 100644
--- a/scripts/docker/default-config.cfg
+++ b/scripts/docker/default-config.cfg
@@ -7,10 +7,13 @@ debug = true
 #syslog = true
 
 #################
-# The frontend section controls how clients connect to the proxy.
-[frontend]
-  tls = false # enable TLS for production!!
+[ldap]
+  enabled = true
   listen = "localhost:389"
+
+[ldaps]
+  enabled = false
+  listen = "0.0.0.0:636"
   cert = "cert.pem"
   key = "key.pem"