diff --git a/README.rst b/README.rst
index 524905546..50c541b3b 100644
--- a/README.rst
+++ b/README.rst
@@ -295,11 +295,11 @@ for callbacks including event and logging notifications:
         ...
     };
 
-To start the client, first create a :code:`ClientAPI::Config` object
+To start the client, first create a :code:`ClientAPI::ProtoConfig` object
 and initialize it with the OpenVPN config file and other options:
 ::
 
-    ClientAPI::Config config;
+    ClientAPI::ProtoConfig config;
     config.content = <config_file_content_as_multiline_string>;
     ...
 
diff --git a/openvpn/client/cliopthelper.hpp b/openvpn/client/cliopthelper.hpp
index 574fb2518..a65d2f055 100644
--- a/openvpn/client/cliopthelper.hpp
+++ b/openvpn/client/cliopthelper.hpp
@@ -298,7 +298,7 @@ class ParseClientConfig
 
             // protocol configuration
             {
-                protoConfig.reset(new ProtoContext::Config());
+                protoConfig.reset(new ProtoContext::ProtoConfig());
                 protoConfig->tls_auth_factory.reset(new CryptoOvpnHMACFactory<SSLLib::CryptoAPI>());
                 protoConfig->tls_crypt_factory.reset(new CryptoTLSCryptFactory<SSLLib::CryptoAPI>());
                 protoConfig->load(options, ProtoContextCompressionOptions(), -1, false);
@@ -792,7 +792,7 @@ class ParseClientConfig
     RemoteList::Ptr remoteList;
     RemoteItem firstRemoteListItem_;
     PeerInfo::Set::Ptr peerInfoUV_;
-    ProtoContext::Config::Ptr protoConfig;
+    ProtoContext::ProtoConfig::Ptr protoConfig;
     SSLLib::SSLAPI::Config::Ptr sslConfig;
     std::string dev;
     std::string windowsDriver_;
diff --git a/openvpn/client/cliproto.hpp b/openvpn/client/cliproto.hpp
index 32f872e99..30126c4d2 100644
--- a/openvpn/client/cliproto.hpp
+++ b/openvpn/client/cliproto.hpp
@@ -105,7 +105,7 @@ class Session : ProtoContext,
 
   public:
     typedef RCPtr<Session> Ptr;
-    typedef Base::Config ProtoConfig;
+    typedef Base::ProtoConfig ProtoConfig;
 
     OPENVPN_EXCEPTION(client_exception);
     OPENVPN_EXCEPTION(client_halt_restart);
@@ -415,7 +415,7 @@ class Session : ProtoContext,
             // encrypt packet
             if (buf.size())
             {
-                const ProtoContext::Config &c = Base::conf();
+                const ProtoContext::ProtoConfig &c = Base::conf();
                 // when calculating mss, we take IPv4 and TCP headers into account
                 // here we need to add it back since we check the whole IP packet size, not just TCP payload
                 constexpr size_t MinTcpHeader = 20;
diff --git a/openvpn/server/manage.hpp b/openvpn/server/manage.hpp
index e9956e0b2..851b12f96 100644
--- a/openvpn/server/manage.hpp
+++ b/openvpn/server/manage.hpp
@@ -69,7 +69,7 @@ struct Send : public virtual RC<thread_unsafe_refcount>
     virtual void auth_request(const AuthCreds::Ptr &auth_creds,
                               const AuthCert::Ptr &auth_cert,
                               const PeerAddr::Ptr &peer_addr) = 0;
-    virtual void push_request(ProtoContext::Config::Ptr pconf) = 0;
+    virtual void push_request(ProtoContext::ProtoConfig::Ptr pconf) = 0;
 
     // INFO notification
     virtual void info_request(const std::string &imsg) = 0;
diff --git a/openvpn/server/servproto.hpp b/openvpn/server/servproto.hpp
index d2b3341cb..440178c0b 100644
--- a/openvpn/server/servproto.hpp
+++ b/openvpn/server/servproto.hpp
@@ -65,10 +65,10 @@ class ServerProto
     {
       public:
         typedef RCPtr<Factory> Ptr;
-        typedef Base::Config ProtoConfig;
+        typedef Base::ProtoConfig ProtoConfig;
 
         Factory(openvpn_io::io_context &io_context_arg,
-                const Base::Config &c)
+                const Base::ProtoConfig &c)
             : io_context(io_context_arg)
         {
             if (c.tls_crypt_enabled())
diff --git a/openvpn/ssl/proto.hpp b/openvpn/ssl/proto.hpp
index 0129f8a1c..e76920f0f 100644
--- a/openvpn/ssl/proto.hpp
+++ b/openvpn/ssl/proto.hpp
@@ -284,10 +284,10 @@ class ProtoContext
     OPENVPN_EXCEPTION_INHERIT(option_error, proto_option_error);
 
     // configuration data passed to ProtoContext constructor
-    class Config : public RCCopyable<thread_unsafe_refcount>
+    class ProtoConfig : public RCCopyable<thread_unsafe_refcount>
     {
       public:
-        typedef RCPtr<Config> Ptr;
+        typedef RCPtr<ProtoConfig> Ptr;
 
         // master SSL context factory
         SSLFactoryAPI::Ptr ssl_factory;
@@ -2020,7 +2020,7 @@ class ProtoContext
             dck.swap(data_channel_key);
         }
 
-        void calculate_mssfix(Config &c)
+        void calculate_mssfix(ProtoConfig &c)
         {
             if (c.mss_parms.fixed)
             {
@@ -2122,7 +2122,7 @@ class ProtoContext
 
             // set up crypto for data channel
             bool enable_compress = true;
-            Config &c = *proto.config;
+            ProtoConfig &c = *proto.config;
             const unsigned int key_dir = proto.is_server() ? OpenVPNStaticKey::INVERSE : OpenVPNStaticKey::NORMAL;
             const OpenVPNStaticKey &key = data_channel_key->key;
 
@@ -3377,7 +3377,7 @@ class ProtoContext
       public:
         OPENVPN_SIMPLE_EXCEPTION(tls_auth_pre_validate);
 
-        TLSAuthPreValidate(const Config &c, const bool server)
+        TLSAuthPreValidate(const ProtoConfig &c, const bool server)
         {
             if (!c.tls_auth_enabled())
                 throw tls_auth_pre_validate();
@@ -3438,7 +3438,7 @@ class ProtoContext
       public:
         OPENVPN_SIMPLE_EXCEPTION(tls_crypt_pre_validate);
 
-        TLSCryptPreValidate(const Config &c, const bool server)
+        TLSCryptPreValidate(const ProtoConfig &c, const bool server)
         {
             if (!c.tls_crypt_enabled())
                 throw tls_crypt_pre_validate();
@@ -3512,7 +3512,7 @@ class ProtoContext
       public:
         OPENVPN_SIMPLE_EXCEPTION(tls_crypt_v2_pre_validate);
 
-        TLSCryptV2PreValidate(const Config &c, const bool server)
+        TLSCryptV2PreValidate(const ProtoConfig &c, const bool server)
             : TLSCryptPreValidate(c, server)
         {
             if (!c.tls_crypt_v2_enabled())
@@ -3526,7 +3526,7 @@ class ProtoContext
 
     OPENVPN_SIMPLE_EXCEPTION(select_key_context_error);
 
-    ProtoContext(const Config::Ptr &config_arg,      // configuration
+    ProtoContext(const ProtoConfig::Ptr &config_arg, // configuration
                  const SessionStats::Ptr &stats_arg) // error stats
         : config(config_arg),
           stats(stats_arg),
@@ -3537,7 +3537,7 @@ class ProtoContext
         reset_tls_wrap_mode(*config);
     }
 
-    void reset_tls_wrap_mode(const Config &c)
+    void reset_tls_wrap_mode(const ProtoConfig &c)
     {
         // tls-auth setup
         if (c.tls_crypt_v2_enabled())
@@ -3582,7 +3582,7 @@ class ProtoContext
         return is_bs64_cipher(conf().dc.cipher());
     }
 
-    void reset_tls_crypt(const Config &c, const OpenVPNStaticKey &key)
+    void reset_tls_crypt(const ProtoConfig &c, const OpenVPNStaticKey &key)
     {
         tls_crypt_send = c.tls_crypt_context->new_obj_send();
         tls_crypt_recv = c.tls_crypt_context->new_obj_recv();
@@ -3598,7 +3598,7 @@ class ProtoContext
                              key.slice(OpenVPNStaticKey::CIPHER | OpenVPNStaticKey::DECRYPT | key_dir));
     }
 
-    void set_dynamic_tls_crypt(const Config &c, const KeyContext::Ptr &key_ctx)
+    void set_dynamic_tls_crypt(const ProtoConfig &c, const KeyContext::Ptr &key_ctx)
     {
         OpenVPNStaticKey dyn_key;
         key_ctx->export_key_material(dyn_key, "EXPORTER-OpenVPN-dynamic-tls-crypt");
@@ -3617,7 +3617,7 @@ class ProtoContext
         reset_tls_crypt(c, dyn_key);
     }
 
-    void reset_tls_crypt_server(const Config &c)
+    void reset_tls_crypt_server(const ProtoConfig &c)
     {
         // tls-crypt session key is derived later from WKc received from the client
         tls_crypt_send.reset();
@@ -3637,7 +3637,7 @@ class ProtoContext
 
     void reset()
     {
-        const Config &c = *config;
+        const ProtoConfig &c = *config;
 
         // defer data channel initialization until after client options pull?
         dc_deferred = c.dc_deferred;
@@ -4097,15 +4097,15 @@ class ProtoContext
     }
 
     // configuration
-    const Config &conf() const
+    const ProtoConfig &conf() const
     {
         return *config;
     }
-    Config &conf()
+    ProtoConfig &conf()
     {
         return *config;
     }
-    Config::Ptr conf_ptr() const
+    ProtoConfig::Ptr conf_ptr() const
     {
         return config;
     }
@@ -4443,7 +4443,7 @@ class ProtoContext
 
     // BEGIN ProtoContext data members
 
-    Config::Ptr config;
+    ProtoConfig::Ptr config;
     SessionStats::Ptr stats;
 
     size_t hmac_size;
diff --git a/test/unittests/test_proto.cpp b/test/unittests/test_proto.cpp
index 295e4c7f5..4d8d7afeb 100644
--- a/test/unittests/test_proto.cpp
+++ b/test/unittests/test_proto.cpp
@@ -368,7 +368,7 @@ class TestProto : public ProtoContext
 
     OPENVPN_EXCEPTION(session_invalidated);
 
-    TestProto(const Base::Config::Ptr &config,
+    TestProto(const Base::ProtoConfig::Ptr &config,
               const SessionStats::Ptr &stats)
         : Base(config, stats),
           control_drought("control", config->now),
@@ -602,7 +602,7 @@ class TestProtoClient : public TestProto
     typedef TestProto Base;
 
   public:
-    TestProtoClient(const Base::Config::Ptr &config,
+    TestProtoClient(const Base::ProtoConfig::Ptr &config,
                     const SessionStats::Ptr &stats)
         : Base(config, stats)
     {
@@ -625,7 +625,7 @@ class TestProtoServer : public TestProto
   public:
     OPENVPN_SIMPLE_EXCEPTION(auth_failed);
 
-    TestProtoServer(const Base::Config::Ptr &config,
+    TestProtoServer(const Base::ProtoConfig::Ptr &config,
                     const SessionStats::Ptr &stats)
         : Base(config, stats)
     {
@@ -923,7 +923,7 @@ int test(const int thread_num)
 
         // client ProtoContext config
         typedef ProtoContext ClientProtoContext;
-        ClientProtoContext::Config::Ptr cp(new ClientProtoContext::Config);
+        ClientProtoContext::ProtoConfig::Ptr cp(new ClientProtoContext::ProtoConfig);
         cp->ssl_factory = cc->new_factory();
         CryptoAlgs::allow_default_dc_algs<ClientCryptoAPI>(cp->ssl_factory->libctx(), false, false);
         cp->dc.set_factory(new CryptoDCSelect<ClientCryptoAPI>(cp->ssl_factory->libctx(), frame, cli_stats, prng_cli));
@@ -965,7 +965,7 @@ int test(const int thread_num)
             tls_crypt_v2_key.extract_key(cp->tls_key);
             tls_crypt_v2_key.extract_wkc(cp->wkc);
         }
-        cp->tls_crypt_ = ClientProtoContext::Config::TLSCrypt::V2;
+        cp->tls_crypt_ = ClientProtoContext::ProtoConfig::TLSCrypt::V2;
 #endif
         cp->pid_mode = PacketIDReceive::UDP_MODE;
 #if defined(HANDSHAKE_WINDOW)
@@ -1013,7 +1013,7 @@ int test(const int thread_num)
 
         // server ProtoContext config
         typedef ProtoContext ServerProtoContext;
-        ServerProtoContext::Config::Ptr sp(new ServerProtoContext::Config);
+        ServerProtoContext::ProtoConfig::Ptr sp(new ServerProtoContext::ProtoConfig);
         sp->ssl_factory = sc->new_factory();
         sp->dc.set_factory(new CryptoDCSelect<ServerCryptoAPI>(sp->ssl_factory->libctx(), frame, serv_stats, prng_serv));
         sp->tlsprf_factory.reset(new CryptoTLSPRFFactory<ServerCryptoAPI>());
@@ -1054,7 +1054,7 @@ int test(const int thread_num)
         }
         sp->set_tls_crypt_algs();
         sp->tls_crypt_metadata_factory.reset(new CryptoTLSCryptMetadataFactory());
-        sp->tls_crypt_ = ClientProtoContext::Config::TLSCrypt::V2;
+        sp->tls_crypt_ = ClientProtoContext::ProtoConfig::TLSCrypt::V2;
 #endif
         sp->pid_mode = PacketIDReceive::UDP_MODE;
 #if defined(HANDSHAKE_WINDOW)