diff --git a/conf/cassandra.yaml b/conf/cassandra.yaml
index 9c74475a6c..73cac902d3 100644
--- a/conf/cassandra.yaml
+++ b/conf/cassandra.yaml
@@ -634,20 +634,16 @@ server_encryption_options:
     # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]
 
 # enable or disable client/server encryption.
-# The available internode options are: none, all
 client_encryption_options:
-    internode_encryption: none
+    enabled: false
     keystore: conf/.keystore
     keystore_password: cassandra
-    truststore: conf/.truststore
-    truststore_password: cassandra
     # More advanced defaults below:
     # protocol: TLS
     # algorithm: SunX509
     # store_type: JKS
     # cipher_suites: [TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]
 
-
 # internode_compression controls whether traffic between nodes is
 # compressed.
 # can be:  all  - all traffic is compressed
diff --git a/src/java/org/apache/cassandra/cli/CliSessionState.java b/src/java/org/apache/cassandra/cli/CliSessionState.java
index 08375bbb0f..d36b7f3b97 100644
--- a/src/java/org/apache/cassandra/cli/CliSessionState.java
+++ b/src/java/org/apache/cassandra/cli/CliSessionState.java
@@ -22,6 +22,7 @@ import java.io.PrintStream;
 
 import org.apache.cassandra.cli.transport.FramedTransportFactory;
 import org.apache.cassandra.config.EncryptionOptions;
+import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
 import org.apache.cassandra.tools.NodeProbe;
 import org.apache.thrift.transport.TTransportFactory;
 
@@ -43,7 +44,7 @@ public class CliSessionState
     public boolean verbose = false; // verbose output
     public int     schema_mwt = 10 * 1000;    // Schema migration wait time (secs.)
     public TTransportFactory transportFactory = new FramedTransportFactory();
-    public EncryptionOptions encOptions = new EncryptionOptions();
+    public EncryptionOptions encOptions = new ClientEncryptionOptions();
 
     /*
      * Streams to read/write from
diff --git a/src/java/org/apache/cassandra/config/Config.java b/src/java/org/apache/cassandra/config/Config.java
index d2f268a848..15f48b6a15 100644
--- a/src/java/org/apache/cassandra/config/Config.java
+++ b/src/java/org/apache/cassandra/config/Config.java
@@ -18,6 +18,8 @@
 package org.apache.cassandra.config;
 
 import org.apache.cassandra.cache.SerializingCacheProvider;
+import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
+import org.apache.cassandra.config.EncryptionOptions.ServerEncryptionOptions;
 import org.apache.cassandra.io.util.NativeAllocator;
 
 /**
@@ -127,10 +129,10 @@ public class Config
     public RequestSchedulerId request_scheduler_id;
     public RequestSchedulerOptions request_scheduler_options;
 
-    public EncryptionOptions server_encryption_options = new EncryptionOptions();
-    public EncryptionOptions client_encryption_options = new EncryptionOptions();
+    public ServerEncryptionOptions server_encryption_options = new ServerEncryptionOptions();
+    public ClientEncryptionOptions client_encryption_options = new ClientEncryptionOptions();
     // this encOptions is for backward compatibility (a warning is logged by DatabaseDescriptor)
-    public EncryptionOptions encryption_options;
+    public ServerEncryptionOptions encryption_options;
 
     public InternodeCompression internode_compression = InternodeCompression.none;
 
diff --git a/src/java/org/apache/cassandra/config/DatabaseDescriptor.java b/src/java/org/apache/cassandra/config/DatabaseDescriptor.java
index e14e58938f..48b9f004a3 100644
--- a/src/java/org/apache/cassandra/config/DatabaseDescriptor.java
+++ b/src/java/org/apache/cassandra/config/DatabaseDescriptor.java
@@ -33,6 +33,8 @@ import org.slf4j.LoggerFactory;
 import org.apache.cassandra.auth.*;
 import org.apache.cassandra.cache.IRowCacheProvider;
 import org.apache.cassandra.config.Config.RequestSchedulerId;
+import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
+import org.apache.cassandra.config.EncryptionOptions.ServerEncryptionOptions;
 import org.apache.cassandra.db.ColumnFamilyStore;
 import org.apache.cassandra.db.DefsTable;
 import org.apache.cassandra.db.SystemTable;
@@ -1094,12 +1096,12 @@ public class DatabaseDescriptor
         conf.dynamic_snitch_badness_threshold = dynamicBadnessThreshold;
     }
 
-    public static EncryptionOptions getServerEncryptionOptions()
+    public static ServerEncryptionOptions getServerEncryptionOptions()
     {
         return conf.server_encryption_options;
     }
 
-    public static EncryptionOptions getClientEncryptionOptions()
+    public static ClientEncryptionOptions getClientEncryptionOptions()
     {
         return conf.client_encryption_options;
     }
diff --git a/src/java/org/apache/cassandra/config/EncryptionOptions.java b/src/java/org/apache/cassandra/config/EncryptionOptions.java
index b516b1b61f..b8a5a91668 100644
--- a/src/java/org/apache/cassandra/config/EncryptionOptions.java
+++ b/src/java/org/apache/cassandra/config/EncryptionOptions.java
@@ -17,9 +17,8 @@
  */
 package org.apache.cassandra.config;
 
-public class EncryptionOptions
+public abstract class EncryptionOptions
 {
-    public InternodeEncryption internode_encryption = InternodeEncryption.none;
     public String keystore = "conf/.keystore";
     public String keystore_password = "cassandra";
     public String truststore = "conf/.truststore";
@@ -29,12 +28,17 @@ public class EncryptionOptions
     public String algorithm = "SunX509";
     public String store_type = "JKS";
 
-
-    public static enum InternodeEncryption
+    public static class ClientEncryptionOptions extends EncryptionOptions
     {
-        all,
-        none,
-        dc,
-        rack
+        public boolean enabled = false;
+    }
+
+    public static class ServerEncryptionOptions extends EncryptionOptions
+    {
+        public static enum InternodeEncryption
+        {
+            all, none, dc, rack
+        }
+        public InternodeEncryption internode_encryption = InternodeEncryption.none;
     }
 }
diff --git a/src/java/org/apache/cassandra/net/MessagingService.java b/src/java/org/apache/cassandra/net/MessagingService.java
index cce3925a91..0b69014915 100644
--- a/src/java/org/apache/cassandra/net/MessagingService.java
+++ b/src/java/org/apache/cassandra/net/MessagingService.java
@@ -43,7 +43,7 @@ import org.apache.cassandra.concurrent.DebuggableThreadPoolExecutor;
 import org.apache.cassandra.concurrent.Stage;
 import org.apache.cassandra.concurrent.StageManager;
 import org.apache.cassandra.config.DatabaseDescriptor;
-import org.apache.cassandra.config.EncryptionOptions;
+import org.apache.cassandra.config.EncryptionOptions.ServerEncryptionOptions;
 import org.apache.cassandra.db.*;
 import org.apache.cassandra.dht.BootStrapper;
 import org.apache.cassandra.exceptions.ConfigurationException;
@@ -396,7 +396,7 @@ public final class MessagingService implements MessagingServiceMBean
     private List<ServerSocket> getServerSocket(InetAddress localEp) throws ConfigurationException
     {
         final List<ServerSocket> ss = new ArrayList<ServerSocket>(2);
-        if (DatabaseDescriptor.getServerEncryptionOptions().internode_encryption != EncryptionOptions.InternodeEncryption.none)
+        if (DatabaseDescriptor.getServerEncryptionOptions().internode_encryption != ServerEncryptionOptions.InternodeEncryption.none)
         {
             try
             {
diff --git a/src/java/org/apache/cassandra/thrift/CustomTHsHaServer.java b/src/java/org/apache/cassandra/thrift/CustomTHsHaServer.java
index 01431367b5..250a54995e 100644
--- a/src/java/org/apache/cassandra/thrift/CustomTHsHaServer.java
+++ b/src/java/org/apache/cassandra/thrift/CustomTHsHaServer.java
@@ -36,7 +36,6 @@ import org.slf4j.LoggerFactory;
 import org.apache.cassandra.concurrent.JMXEnabledThreadPoolExecutor;
 import org.apache.cassandra.concurrent.NamedThreadFactory;
 import org.apache.cassandra.config.DatabaseDescriptor;
-import org.apache.cassandra.config.EncryptionOptions;
 import org.apache.thrift.server.TNonblockingServer;
 import org.apache.thrift.server.TServer;
 import org.apache.thrift.transport.TNonblockingServerTransport;
@@ -352,7 +351,7 @@ public class CustomTHsHaServer extends TNonblockingServer
     {
         public TServer buildTServer(Args args)
         {
-            if(!DatabaseDescriptor.getClientEncryptionOptions().internode_encryption.equals(EncryptionOptions.InternodeEncryption.none))
+            if (DatabaseDescriptor.getClientEncryptionOptions().enabled)
                 throw new RuntimeException("Client SSL is not supported for non-blocking sockets (hsha). Please remove client ssl from the configuration.");
 
             final InetSocketAddress addr = args.addr;
diff --git a/src/java/org/apache/cassandra/thrift/CustomTNonBlockingServer.java b/src/java/org/apache/cassandra/thrift/CustomTNonBlockingServer.java
index af8289642c..779caf31c3 100644
--- a/src/java/org/apache/cassandra/thrift/CustomTNonBlockingServer.java
+++ b/src/java/org/apache/cassandra/thrift/CustomTNonBlockingServer.java
@@ -20,7 +20,6 @@ package org.apache.cassandra.thrift;
 import java.net.InetSocketAddress;
 
 import org.apache.cassandra.config.DatabaseDescriptor;
-import org.apache.cassandra.config.EncryptionOptions;
 import org.apache.thrift.server.TNonblockingServer;
 import org.apache.thrift.server.TServer;
 import org.apache.thrift.transport.TNonblockingServerTransport;
@@ -47,7 +46,7 @@ public class CustomTNonBlockingServer extends TNonblockingServer
     {
         public TServer buildTServer(Args args)
         {
-            if(!DatabaseDescriptor.getClientEncryptionOptions().internode_encryption.equals(EncryptionOptions.InternodeEncryption.none))
+            if (DatabaseDescriptor.getClientEncryptionOptions().enabled)
                 throw new RuntimeException("Client SSL is not supported for non-blocking sockets. Please remove client ssl from the configuration.");
 
             final InetSocketAddress addr = args.addr;
diff --git a/src/java/org/apache/cassandra/thrift/CustomTThreadPoolServer.java b/src/java/org/apache/cassandra/thrift/CustomTThreadPoolServer.java
index 8b88e43d20..f6ab1f7e97 100644
--- a/src/java/org/apache/cassandra/thrift/CustomTThreadPoolServer.java
+++ b/src/java/org/apache/cassandra/thrift/CustomTThreadPoolServer.java
@@ -31,7 +31,7 @@ import org.slf4j.LoggerFactory;
 
 import org.apache.cassandra.concurrent.NamedThreadFactory;
 import org.apache.cassandra.config.DatabaseDescriptor;
-import org.apache.cassandra.config.EncryptionOptions;
+import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
 import org.apache.thrift.TException;
 import org.apache.thrift.TProcessor;
 import org.apache.thrift.protocol.TProtocol;
@@ -243,13 +243,12 @@ public class CustomTThreadPoolServer extends TServer
             TServerTransport serverTransport;
             try
             {
-                final EncryptionOptions clientEnc = DatabaseDescriptor.getClientEncryptionOptions();
-                if(EncryptionOptions.InternodeEncryption.all == clientEnc.internode_encryption)
+                final ClientEncryptionOptions clientEnc = DatabaseDescriptor.getClientEncryptionOptions();
+                if (clientEnc.enabled)
                 {
                     logger.info("enabling encrypted thrift connections between client and server");
                     TSSLTransportParameters params = new TSSLTransportParameters(clientEnc.protocol, clientEnc.cipher_suites);
                     params.setKeyStore(clientEnc.keystore, clientEnc.keystore_password);
-                    params.setTrustStore(clientEnc.truststore, clientEnc.truststore_password);
                     TServerSocket sslServer = TSSLTransportFactory.getServerSocket(addr.getPort(), 0, addr.getAddress(), params);
                     serverTransport = new TCustomServerSocket(sslServer.getServerSocket(), args.keepAlive, args.sendBufferSize, args.recvBufferSize);
                 }
diff --git a/tools/stress/src/org/apache/cassandra/stress/Session.java b/tools/stress/src/org/apache/cassandra/stress/Session.java
index ac109a1ece..a0c3617f19 100644
--- a/tools/stress/src/org/apache/cassandra/stress/Session.java
+++ b/tools/stress/src/org/apache/cassandra/stress/Session.java
@@ -28,6 +28,7 @@ import java.util.concurrent.atomic.AtomicLong;
 import org.apache.cassandra.cli.transport.FramedTransportFactory;
 import org.apache.cassandra.config.CFMetaData;
 import org.apache.cassandra.config.EncryptionOptions;
+import org.apache.cassandra.config.EncryptionOptions.ClientEncryptionOptions;
 import org.apache.cassandra.exceptions.ConfigurationException;
 import org.apache.cassandra.exceptions.SyntaxException;
 import org.apache.cassandra.db.marshal.*;
@@ -160,7 +161,7 @@ public class Session implements Serializable
     public final String comparator;
     public final boolean timeUUIDComparator;
     public double traceProbability = 0.0;
-    public EncryptionOptions encOptions = new EncryptionOptions();
+    public EncryptionOptions encOptions = new ClientEncryptionOptions();
     public TTransportFactory transportFactory = new FramedTransportFactory();
 
     public Session(String[] arguments) throws IllegalArgumentException, SyntaxException