diff --git a/cmd/neofs-node/config.go b/cmd/neofs-node/config.go
index bf37d324..bd66a435 100644
--- a/cmd/neofs-node/config.go
+++ b/cmd/neofs-node/config.go
@@ -18,6 +18,7 @@ import (
 	"github.com/nspcc-dev/neofs-node/cmd/neofs-node/config"
 	engineconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/engine"
 	shardconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/engine/shard"
+	grpcconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/grpc"
 	loggerconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/logger"
 	metricsconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/metrics"
 	nodeconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/node"
@@ -53,12 +54,6 @@ import (
 )
 
 const (
-	// config keys for cfgGRPC
-	cfgListenAddress = "grpc.endpoint"
-	cfgTLSEnabled    = "grpc.tls.enabled"
-	cfgTLSCertFile   = "grpc.tls.certificate"
-	cfgTLSKeyFile    = "grpc.tls.key"
-
 	// config keys for API client cache
 	cfgAPIClientDialTimeout = "apiclient.dial_timeout"
 
@@ -306,12 +301,14 @@ func initCfg(path string) *cfg {
 		tlsEnabled  bool
 		tlsCertFile string
 		tlsKeyFile  string
+
+		tlsConfig = grpcconfig.TLS(appCfg)
 	)
 
-	if viperCfg.GetBool(cfgTLSEnabled) {
+	if tlsConfig.Enabled() {
 		tlsEnabled = true
-		tlsCertFile = viperCfg.GetString(cfgTLSCertFile)
-		tlsKeyFile = viperCfg.GetString(cfgTLSKeyFile)
+		tlsCertFile = tlsConfig.CertificateFile()
+		tlsKeyFile = tlsConfig.KeyFile()
 	}
 
 	if tlsEnabled {
@@ -412,11 +409,6 @@ func defaultConfiguration(v *viper.Viper) {
 	v.SetDefault(cfgMorphNotifyRPCAddress, []string{})
 	v.SetDefault(cfgMorphNotifyDialTimeout, 5*time.Second)
 
-	v.SetDefault(cfgListenAddress, "127.0.0.1:50501") // listen address
-	v.SetDefault(cfgTLSEnabled, false)
-	v.SetDefault(cfgTLSCertFile, "")
-	v.SetDefault(cfgTLSKeyFile, "")
-
 	v.SetDefault(cfgAPIClientDialTimeout, 5*time.Second)
 
 	v.SetDefault(cfgAccountingContract, "")
diff --git a/cmd/neofs-node/control.go b/cmd/neofs-node/control.go
index 194418aa..1238f06d 100644
--- a/cmd/neofs-node/control.go
+++ b/cmd/neofs-node/control.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/nspcc-dev/neofs-api-go/pkg/object"
 	crypto "github.com/nspcc-dev/neofs-crypto"
+	grpcconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/grpc"
 	"github.com/nspcc-dev/neofs-node/pkg/local_object_storage/engine"
 	"github.com/nspcc-dev/neofs-node/pkg/services/control"
 	controlSvc "github.com/nspcc-dev/neofs-node/pkg/services/control/server"
@@ -61,7 +62,7 @@ func initControlService(c *cfg) {
 		endpoint = c.viper.GetString(cfgCtrlGRPCEndpoint)
 	)
 
-	if endpoint == "" || endpoint == c.viper.GetString(cfgListenAddress) {
+	if endpoint == "" || endpoint == grpcconfig.Endpoint(c.appCfg) {
 		lis = c.cfgGRPC.listener
 		c.cfgControlService.server = c.cfgGRPC.server
 	} else {
diff --git a/cmd/neofs-node/grpc.go b/cmd/neofs-node/grpc.go
index 588df307..ef9c39a0 100644
--- a/cmd/neofs-node/grpc.go
+++ b/cmd/neofs-node/grpc.go
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"net"
 
+	grpcconfig "github.com/nspcc-dev/neofs-node/cmd/neofs-node/config/grpc"
 	"github.com/nspcc-dev/neofs-node/pkg/util/logger"
 	"go.uber.org/zap"
 	"google.golang.org/grpc"
@@ -13,7 +14,7 @@ import (
 func initGRPC(c *cfg) {
 	var err error
 
-	c.cfgGRPC.listener, err = net.Listen("tcp", c.viper.GetString(cfgListenAddress))
+	c.cfgGRPC.listener, err = net.Listen("tcp", grpcconfig.Endpoint(c.appCfg))
 	fatalOnErr(err)
 
 	serverOpts := []grpc.ServerOption{