diff --git a/src/config_new_tls.c b/src/config_new_tls.c
index 8e9cb9d..7e59c98 100644
--- a/src/config_new_tls.c
+++ b/src/config_new_tls.c
@@ -108,8 +108,8 @@
 }
 
 API int
-nc_server_config_new_tls_server_certificate(const struct ly_ctx *ctx, const char *endpt_name, const char *pubkey_path,
-        const char *privkey_path, const char *certificate_path, struct lyd_node **config)
+nc_server_config_new_tls_server_certificate(const struct ly_ctx *ctx, const char *endpt_name, const char *privkey_path,
+        const char *pubkey_path, const char *certificate_path, struct lyd_node **config)
 {
     int ret = 0;
     char *path = NULL;
@@ -147,7 +147,7 @@
 
 API int
 nc_server_config_new_ch_tls_server_certificate(const struct ly_ctx *ctx, const char *client_name, const char *endpt_name,
-        const char *pubkey_path, const char *privkey_path, const char *certificate_path, struct lyd_node **config)
+        const char *privkey_path, const char *pubkey_path, const char *certificate_path, struct lyd_node **config)
 {
     int ret = 0;
     char *path = NULL;
diff --git a/src/server_config.h b/src/server_config.h
index 2bddb31..50f7c32 100644
--- a/src/server_config.h
+++ b/src/server_config.h
@@ -658,16 +658,16 @@
  * @param[in] ctx libyang context.
  * @param[in] endpt_name Arbitrary identifier of the endpoint.
  * If an endpoint with this identifier already exists, its server certificate will be changed.
+ * @param[in] privkey_path Path to the server's PEM encoded private key file.
  * @param[in] pubkey_path Optional path to the server's public key file. If not provided,
  * it will be generated from the private key.
- * @param[in] privkey_path Path to the server's private key file.
  * @param[in] certificate_path Path to the server's certificate file.
  * @param[in,out] config Configuration YANG data tree. If *config is NULL, it will be created.
  * Otherwise the new YANG data will be added to the previous data and may override it.
  * @return 0 on success, non-zero otherwise.
  */
-int nc_server_config_new_tls_server_certificate(const struct ly_ctx *ctx, const char *endpt_name, const char *pubkey_path,
-        const char *privkey_path, const char *certificate_path, struct lyd_node **config);
+int nc_server_config_new_tls_server_certificate(const struct ly_ctx *ctx, const char *endpt_name, const char *privkey_path,
+        const char *pubkey_path, const char *certificate_path, struct lyd_node **config);
 
 /**
  * @brief Deletes the server's certificate from the YANG data.
@@ -1583,16 +1583,16 @@
  * If a Call Home client with this identifier already exists, its contents will be changed.
  * @param[in] endpt_name Arbitrary identifier of the Call Home client's endpoint.
  * If a Call Home client's endpoint with this identifier already exists, its contents will be changed.
+ * @param[in] privkey_path Path to the server's PEM encoded private key file.
  * @param[in] pubkey_path Optional path to the server's public key file. If not provided,
  * it will be generated from the private key.
- * @param[in] privkey_path Path to the server's private key file.
  * @param[in] certificate_path Path to the server's certificate file.
  * @param[in,out] config Configuration YANG data tree. If *config is NULL, it will be created.
  * Otherwise the new YANG data will be added to the previous data and may override it.
  * @return 0 on success, non-zero otherwise.
  */
 int nc_server_config_new_ch_tls_server_certificate(const struct ly_ctx *ctx, const char *client_name, const char *endpt_name,
-        const char *pubkey_path, const char *privkey_path, const char *certificate_path, struct lyd_node **config);
+        const char *privkey_path, const char *pubkey_path, const char *certificate_path, struct lyd_node **config);
 
 /**
  * @brief Deletes a Call Home server certificate from the YANG data.
diff --git a/tests/test_ch.c b/tests/test_ch.c
index 735267b..13ab75e 100644
--- a/tests/test_ch.c
+++ b/tests/test_ch.c
@@ -400,7 +400,7 @@
     assert_int_equal(ret, 0);
 
     /* set call-home server certificate */
-    ret = nc_server_config_new_ch_tls_server_certificate(ctx, "ch_tls", "endpt", NULL, TESTS_DIR "/data/server.key", TESTS_DIR "/data/server.crt", &test_state->tls_tree);
+    ret = nc_server_config_new_ch_tls_server_certificate(ctx, "ch_tls", "endpt", TESTS_DIR "/data/server.key", NULL, TESTS_DIR "/data/server.crt", &test_state->tls_tree);
     assert_int_equal(ret, 0);
 
     /* set call-home client end entity certificate */
diff --git a/tests/test_crl.c b/tests/test_crl.c
index 126fda9..7a9cf44 100644
--- a/tests/test_crl.c
+++ b/tests/test_crl.c
@@ -148,7 +148,7 @@
     assert_int_equal(ret, 0);
 
     /* create new server certificate data */
-    ret = nc_server_config_new_tls_server_certificate(ctx, "endpt", NULL, TESTS_DIR "/data/server.key", TESTS_DIR "/data/server.crt", &tree);
+    ret = nc_server_config_new_tls_server_certificate(ctx, "endpt", TESTS_DIR "/data/server.key", NULL, TESTS_DIR "/data/server.crt", &tree);
     assert_int_equal(ret, 0);
 
     /* create new end entity client cert data */
diff --git a/tests/test_endpt_share_clients.c b/tests/test_endpt_share_clients.c
index a18210b..037da46 100644
--- a/tests/test_endpt_share_clients.c
+++ b/tests/test_endpt_share_clients.c
@@ -256,8 +256,7 @@
     assert_int_equal(ret, 0);
 
     /* create the first TLS endpoint with a single end entity client cert and a CTN entry */
-    ret = nc_server_config_new_tls_server_certificate(ctx, "TLS_endpt_1", NULL,
-            TESTS_DIR "/data/server.key", TESTS_DIR "/data/server.crt", &tree);
+    ret = nc_server_config_new_tls_server_certificate(ctx, "TLS_endpt_1", TESTS_DIR "/data/server.key", NULL, TESTS_DIR "/data/server.crt", &tree);
     assert_int_equal(ret, 0);
 
     ret = nc_server_config_new_address_port(ctx, "TLS_endpt_1", NC_TI_OPENSSL, "127.0.0.1", 10007, &tree);
@@ -275,8 +274,8 @@
     assert_int_equal(ret, 0);
 
     /* create the second TLS endpoint with a reference to the first endpoint */
-    ret = nc_server_config_new_tls_server_certificate(ctx, "TLS_endpt_2", NULL,
-            TESTS_DIR "/data/server.key", TESTS_DIR "/data/server.crt", &tree);
+    ret = nc_server_config_new_tls_server_certificate(ctx, "TLS_endpt_2",
+            TESTS_DIR "/data/server.key", NULL, TESTS_DIR "/data/server.crt", &tree);
     assert_int_equal(ret, 0);
 
     ret = nc_server_config_new_address_port(ctx, "TLS_endpt_2", NC_TI_OPENSSL, "127.0.0.1", 10008, &tree);
diff --git a/tests/test_tls.c b/tests/test_tls.c
index 90970ee..ed0966b 100644
--- a/tests/test_tls.c
+++ b/tests/test_tls.c
@@ -142,7 +142,7 @@
     assert_int_equal(ret, 0);
 
     /* create new server certificate data */
-    ret = nc_server_config_new_tls_server_certificate(ctx, "endpt", NULL, TESTS_DIR "/data/server.key", TESTS_DIR "/data/server.crt", &tree);
+    ret = nc_server_config_new_tls_server_certificate(ctx, "endpt", TESTS_DIR "/data/server.key", NULL, TESTS_DIR "/data/server.crt", &tree);
     assert_int_equal(ret, 0);
 
     /* create new end entity client cert data */