diff --git a/src/ebusd/main.cpp b/src/ebusd/main.cpp
index 75cfa877..913b2047 100644
--- a/src/ebusd/main.cpp
+++ b/src/ebusd/main.cpp
@@ -882,6 +882,7 @@ int main(int argc, char* argv[], char* envp[]) {
   const string lang = MappedFileReader::normalizeLanguage(
     s_opt.preferLanguage == nullptr || !s_opt.preferLanguage[0] ? "" : s_opt.preferLanguage);
   string configLocalPrefix, configUriPrefix;
+  HttpClient::initialize(s_opt.caFile, s_opt.caPath);
   HttpClient* configHttpClient = nullptr;
   if (s_configPath.find("://") == string::npos) {
     configLocalPrefix = s_configPath;
@@ -909,7 +910,7 @@ int main(int argc, char* argv[], char* envp[]) {
       logWrite(lf_main, ll_error, "invalid configPath URL");  // force logging on exit
       return EINVAL;
     }
-    configHttpClient = new HttpClient(s_opt.caFile, s_opt.caPath);
+    configHttpClient = new HttpClient();
     if (
       // check with low timeout of 1 second initially:
       !configHttpClient->connect(configHost, configPort, proto == "https", PACKAGE_NAME "/" PACKAGE_VERSION, 1)
diff --git a/src/ebusd/mainloop.cpp b/src/ebusd/mainloop.cpp
index d59745f9..4f426f03 100644
--- a/src/ebusd/mainloop.cpp
+++ b/src/ebusd/mainloop.cpp
@@ -109,7 +109,7 @@ MainLoop::MainLoop(const struct options& opt, Device *device, MessageMap* messag
   : Thread(), m_device(device), m_reconnectCount(0), m_userList(opt.accessLevel), m_messages(messages),
     m_scanHelper(scanHelper), m_address(opt.address), m_scanConfig(opt.scanConfig),
     m_initialScan(opt.readOnly ? ESC : opt.initialScan), m_polling(opt.pollInterval > 0), m_enableHex(opt.enableHex),
-    m_shutdown(false), m_runUpdateCheck(opt.updateCheck), m_httpClient(opt.caFile, opt.caPath) {
+    m_shutdown(false), m_runUpdateCheck(opt.updateCheck), m_httpClient() {
   m_device->setListener(this);
   // open Device
   result_t result = m_device->open();
diff --git a/src/lib/utils/httpclient.cpp b/src/lib/utils/httpclient.cpp
index 5e177a13..0472671a 100755
--- a/src/lib/utils/httpclient.cpp
+++ b/src/lib/utils/httpclient.cpp
@@ -300,18 +300,22 @@ SSLSocket* SSLSocket::connect(const string& host, const uint16_t& port, bool htt
 }
 
 bool HttpClient::s_initialized = false;
+const char* HttpClient::s_caFile = nullptr;
+const char* HttpClient::s_caPath = nullptr;
 
-void HttpClient::initialize() {
+void HttpClient::initialize(const char* caFile, const char* caPath) {
   if (s_initialized) {
     return;
   }
   s_initialized = true;
+  s_caFile = caFile;
+  s_caPath = caPath;
   SSL_library_init();
   SSL_load_error_strings();
   signal(SIGPIPE, SIG_IGN);  // needed to avoid SIGPIPE when writing to a closed pipe
 }
 #else  // HAVE_SSL
-void HttpClient::initialize() {
+void HttpClient::initialize(const char* caFile, const char* caPath) {
   // empty
 }
 #endif  // HAVE_SSL
@@ -369,7 +373,7 @@ bool HttpClient::connect(const string& host, const uint16_t port, bool https, co
   initialize();
   disconnect();
 #ifdef HAVE_SSL
-  m_socket = SSLSocket::connect(host, port, https, timeout, m_caFile, m_caPath);
+  m_socket = SSLSocket::connect(host, port, https, timeout, s_caFile, s_caPath);
   m_https = https;
 #else
   if (https) {
@@ -393,7 +397,7 @@ bool HttpClient::reconnect() {
     return false;
   }
 #ifdef HAVE_SSL
-  m_socket = SSLSocket::connect(m_host, m_port, m_https, m_timeout, m_caFile, m_caPath);
+  m_socket = SSLSocket::connect(m_host, m_port, m_https, m_timeout, s_caFile, s_caPath);
 #else
   m_socket = TCPSocket::connect(m_host, m_port, m_timeout);
 #endif
diff --git a/src/lib/utils/httpclient.h b/src/lib/utils/httpclient.h
index 94fd7a6f..89493dfe 100755
--- a/src/lib/utils/httpclient.h
+++ b/src/lib/utils/httpclient.h
@@ -118,20 +118,12 @@ class HttpClient {
  public:
   /**
    * Constructor.
-   * @param caFile the CA file to use (uses defaults if neither caFile nor caPath are set), or "#" for insecure.
-   * @param caPath the path with CA files to use (uses defaults if neither caFile nor caPath are set).
-   * @param init whether to immediately initialize the library (instead of during connect()).
    */
-  explicit HttpClient(const char* caFile = nullptr, const char* caPath = nullptr, bool init = true) :
+  HttpClient() :
 #ifdef HAVE_SSL
     m_https(false),
-    m_caFile(caFile),
-    m_caPath(caPath),
 #endif
     m_socket(nullptr), m_port(0), m_timeout(0), m_bufferSize(0), m_buffer(nullptr) {
-    if (init) {
-      initialize();
-    }
   }
 
   /**
@@ -146,9 +138,11 @@ class HttpClient {
   }
 
   /**
-   * Initialize HttpClient.
+   * Initialize the underlying SSL library.
+   * @param caFile the CA file to use (uses defaults if neither caFile nor caPath are set), or "#" for insecure.
+   * @param caPath the path with CA files to use (uses defaults if neither caFile nor caPath are set).
    */
-  static void initialize();
+  static void initialize(const char* caFile = nullptr, const char* caPath = nullptr);
 
   /**
    * Parse an HTTP URL.
@@ -238,10 +232,10 @@ class HttpClient {
   bool m_https;
 
   /** the CA file to use. */
-  const char* m_caFile;
+  static const char* s_caFile;
 
   /** the path with CA files to use. */
-  const char* m_caPath;
+  static const char* s_caPath;
 #endif
 
   /** the currently connected socket. */