diff --git a/.gitignore b/.gitignore
index 896b8dd0..9de2763e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -109,3 +109,4 @@ _test
 oragono.prof
 oragono.mprof
 /dist
+*.pem
diff --git a/conventional.yaml b/conventional.yaml
index 2f362b47..d6d1db79 100644
--- a/conventional.yaml
+++ b/conventional.yaml
@@ -24,8 +24,8 @@ server:
         # The standard SSL/TLS port for IRC is 6697. This will listen on all interfaces:
         ":6697":
             tls:
-                key: tls.key
-                cert: tls.crt
+                cert: fullchain.pem
+                key: privkey.pem
                 # 'proxy' should typically be false. It's only for Kubernetes-style load
                 # balancing that does not terminate TLS, but sends an initial PROXY line
                 # in plaintext.
@@ -44,8 +44,8 @@ server:
         # ":8097":
         #     websocket: true
         #     tls:
-        #         key: tls.key
-        #         cert: tls.crt
+        #         cert: fullchain.pem
+        #         key: privkey.pem
 
     # sets the permissions for Unix listen sockets. on a typical Linux system,
     # the default is 0775 or 0755, which prevents other users/groups from connecting
diff --git a/oragono.yaml b/oragono.yaml
index 8b71ea62..6eacba13 100644
--- a/oragono.yaml
+++ b/oragono.yaml
@@ -50,8 +50,8 @@ server:
         # The standard SSL/TLS port for IRC is 6697. This will listen on all interfaces:
         ":6697":
             tls:
-                key: tls.key
-                cert: tls.crt
+                cert: fullchain.pem
+                key: privkey.pem
                 # 'proxy' should typically be false. It's only for Kubernetes-style load
                 # balancing that does not terminate TLS, but sends an initial PROXY line
                 # in plaintext.
@@ -70,8 +70,8 @@ server:
         # ":8097":
         #     websocket: true
         #     tls:
-        #         key: tls.key
-        #         cert: tls.crt
+        #         cert: fullchain.pem
+        #         key: privkey.pem
 
     # sets the permissions for Unix listen sockets. on a typical Linux system,
     # the default is 0775 or 0755, which prevents other users/groups from connecting