diff --git a/config/sample_webconfig.conf b/config/sample_webconfig.conf
index 249ec43..c336ac4 100644
--- a/config/sample_webconfig.conf
+++ b/config/sample_webconfig.conf
@@ -197,24 +197,21 @@ webconfig {
             disable_initial_host_lookup = false
 
             // TLS/SSL configuration (optional when is_ssl_enabled = true)
-            // If tls block is not provided or incomplete, will use insecure TLS
-            tls {
-                // Client certificate for mutual TLS (mTLS) - optional
-                cert_file = "/path/to/client-cert.pem"
-                key_file = "/path/to/client-key.pem"
-
-                // CA certificate for server verification - optional
-                ca_cert_file = "/path/to/ca-cert.pem"
-
-                // Skip certificate verification (INSECURE - for testing only)
-                // When true, allows TLS without certificates or CA validation
-                insecure_skip_verify = false
-
-                // Override SNI hostname sent during TLS handshake.
-                // Required when the certificate uses DNS SANs only (no IP SANs).
-                // Leave empty to use the host IP address (gocql default).
-                server_name = ""
-            }
+            // Client certificate for mutual TLS (mTLS) - optional
+            tls_cert_file = "/path/to/client-cert.pem"
+            tls_key_file = "/path/to/client-key.pem"
+
+            // CA certificate for server verification - optional
+            tls_ca_cert_file = "/path/to/ca-cert.pem"
+
+            // Skip certificate verification (INSECURE - for testing only)
+            // When true, allows TLS without certificates or CA validation
+            tls_insecure_skip_verify = false
+
+            // Override SNI hostname sent during TLS handshake.
+            // Required when the certificate uses DNS SANs only (no IP SANs).
+            // Leave empty to use the host IP address (gocql default).
+            tls_server_name = ""
         }
 
         yugabyte {
@@ -249,24 +246,21 @@ webconfig {
             is_ssl_enabled = true
 
             // TLS/SSL configuration (optional when is_ssl_enabled = true)
-            // If tls block is not provided or incomplete, will use insecure TLS
-            tls {
-                // Client certificate for mutual TLS (mTLS) - optional
-                cert_file = "/path/to/client-cert.pem"
-                key_file = "/path/to/client-key.pem"
-
-                // CA certificate for server verification - optional
-                ca_cert_file = "/path/to/ca-cert.pem"
-
-                // Skip certificate verification (INSECURE - for testing only)
-                // When true, allows TLS without certificates or CA validation
-                insecure_skip_verify = false
-
-                // Override SNI hostname sent during TLS handshake.
-                // Required when the certificate uses DNS SANs only (no IP SANs).
-                // Leave empty to use the host IP address (gocql default).
-                server_name = ""
-            }
+            // Client certificate for mutual TLS (mTLS) - optional
+            tls_cert_file = "/path/to/client-cert.pem"
+            tls_key_file = "/path/to/client-key.pem"
+
+            // CA certificate for server verification - optional
+            tls_ca_cert_file = "/path/to/ca-cert.pem"
+
+            // Skip certificate verification (INSECURE - for testing only)
+            // When true, allows TLS without certificates or CA validation
+            tls_insecure_skip_verify = false
+
+            // Override SNI hostname sent during TLS handshake.
+            // Required when the certificate uses DNS SANs only (no IP SANs).
+            // Leave empty to use the host IP address (gocql default).
+            tls_server_name = ""
         }
     }
 
diff --git a/db/cassandra/cassandra_client.go b/db/cassandra/cassandra_client.go
index 0145d6e..057f898 100644
--- a/db/cassandra/cassandra_client.go
+++ b/db/cassandra/cassandra_client.go
@@ -163,7 +163,7 @@ func NewCassandraClient(conf *configuration.Config, testOnly bool) (*CassandraCl
 	}
 
 	if isSslEnabled {
-		insecureSkipVerify := dbconf.GetBoolean("tls.insecure_skip_verify")
+		insecureSkipVerify := dbconf.GetBoolean("tls_insecure_skip_verify")
 		tlsConfig, err := loadCassandraTLSConfig(dbconf, dbdriver, insecureSkipVerify)
 		if err != nil {
 			return nil, common.NewError(err)
@@ -215,13 +215,13 @@ func NewCassandraClient(conf *configuration.Config, testOnly bool) (*CassandraCl
 
 // loadCassandraTLSConfig loads TLS configuration for Cassandra connection.
 // Returns a tls.Config with certificates loaded from the configuration.
-// The function expects tls.{} block under the database driver config (cassandra or yugabyte).
+// Reads flat tls_* keys directly under the database driver config (cassandra or yugabyte).
 func loadCassandraTLSConfig(dbconf *configuration.Config, dbdriver string, insecureSkipVerify bool) (*tls.Config, error) {
 	// Load client certificates for mTLS if provided (optional when insecure_skip_verify is true)
-	certFile := dbconf.GetString("tls.cert_file")
-	keyFile := dbconf.GetString("tls.key_file")
-	caCertFile := dbconf.GetString("tls.ca_cert_file")
-	serverName := dbconf.GetString("tls.server_name")
+	certFile := dbconf.GetString("tls_cert_file")
+	keyFile := dbconf.GetString("tls_key_file")
+	caCertFile := dbconf.GetString("tls_ca_cert_file")
+	serverName := dbconf.GetString("tls_server_name")
 
 	// Create TLS config for Cassandra connection.
 	// Prefer modern ECDHE+AEAD suites for forward secrecy; keep TLS_RSA_WITH_AES_128_CBC_SHA