diff --git a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
index acecde145..227532580 100644
--- a/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
+++ b/src/charon/plugins/eap_aka_3gpp2/eap_aka_3gpp2_card.c
@@ -158,7 +158,7 @@ eap_aka_3gpp2_card_t *eap_aka_3gpp2_card_create(eap_aka_3gpp2_functions_t *f)
 
 	this->f = f;
 	this->seq_check = lib->settings->get_bool(lib->settings,
-									"charon.plugins.eap_aka_3gpp2.seq_check",
+									"charon.plugins.eap-aka-3gpp2.seq_check",
 #ifdef SEQ_CHECK /* handle legacy compile time configuration as default */
 									TRUE);
 #else /* !SEQ_CHECK */
diff --git a/src/charon/plugins/eap_gtc/eap_gtc.c b/src/charon/plugins/eap_gtc/eap_gtc.c
index f81e42cba..c7f55fa70 100644
--- a/src/charon/plugins/eap_gtc/eap_gtc.c
+++ b/src/charon/plugins/eap_gtc/eap_gtc.c
@@ -227,7 +227,7 @@ static status_t process_server(private_eap_gtc_t *this,
 	password[data.len] = '\0';
 
 	service = lib->settings->get_str(lib->settings,
-						"charon.plugins.eap_gtc.pam_service", GTC_PAM_SERVICE);
+						"charon.plugins.eap-gtc.pam_service", GTC_PAM_SERVICE);
 
 	if (!authenticate(service, user, password))
 	{
diff --git a/src/charon/plugins/eap_radius/eap_radius.c b/src/charon/plugins/eap_radius/eap_radius.c
index f21d6b859..4978a5195 100644
--- a/src/charon/plugins/eap_radius/eap_radius.c
+++ b/src/charon/plugins/eap_radius/eap_radius.c
@@ -292,9 +292,9 @@ eap_radius_t *eap_radius_create(identification_t *server, identification_t *peer
 	this->vendor = 0;
 	this->msk = chunk_empty;
 	this->eap_start = lib->settings->get_bool(lib->settings,
-								"charon.plugins.eap_radius.eap_start", FALSE);
+								"charon.plugins.eap-radius.eap_start", FALSE);
 	this->id_prefix = lib->settings->get_str(lib->settings,
-								"charon.plugins.eap_radius.id_prefix", "");
+								"charon.plugins.eap-radius.id_prefix", "");
 	return &this->public;
 }
 
diff --git a/src/charon/plugins/eap_radius/radius_client.c b/src/charon/plugins/eap_radius/radius_client.c
index 1b35cd2d6..63c3b849f 100644
--- a/src/charon/plugins/eap_radius/radius_client.c
+++ b/src/charon/plugins/eap_radius/radius_client.c
@@ -132,11 +132,11 @@ bool radius_client_init()
 	char *server;
 
 	nas_identifier.ptr = lib->settings->get_str(lib->settings,
-					"charon.plugins.eap_radius.nas_identifier", "strongSwan");
+					"charon.plugins.eap-radius.nas_identifier", "strongSwan");
 	nas_identifier.len = strlen(nas_identifier.ptr);
 
 	secret.ptr = lib->settings->get_str(lib->settings,
-					"charon.plugins.eap_radius.secret", NULL);
+					"charon.plugins.eap-radius.secret", NULL);
 	if (!secret.ptr)
 	{
 		DBG1(DBG_CFG, "no RADUIS secret defined");
@@ -144,21 +144,21 @@ bool radius_client_init()
 	}
 	secret.len = strlen(secret.ptr);
 	server = lib->settings->get_str(lib->settings,
-					"charon.plugins.eap_radius.server", NULL);
+					"charon.plugins.eap-radius.server", NULL);
 	if (!server)
 	{
 		DBG1(DBG_CFG, "no RADUIS server defined");
 		return FALSE;
 	}
 	port = lib->settings->get_int(lib->settings,
-					"charon.plugins.eap_radius.port", RADIUS_PORT);
+					"charon.plugins.eap-radius.port", RADIUS_PORT);
 	host = host_create_from_dns(server, 0, port);
 	if (!host)
 	{
 		return FALSE;
 	}
 	count = lib->settings->get_int(lib->settings,
-					"charon.plugins.eap_radius.sockets", 1);
+					"charon.plugins.eap-radius.sockets", 1);
 
 	sockets = linked_list_create();
 	mutex = mutex_create(MUTEX_TYPE_DEFAULT);
diff --git a/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c b/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c
index d68d2dad5..fc2c2a746 100644
--- a/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c
+++ b/src/charon/plugins/kernel_klips/kernel_klips_ipsec.c
@@ -318,7 +318,7 @@ static status_t attach_ipsec_dev(char* name, char *phys_name)
 	}
 
 	mtu = lib->settings->get_int(lib->settings,
-						"charon.plugins.kernel_klips.ipsec_dev_mtu", 0);
+						"charon.plugins.kernel-klips.ipsec_dev_mtu", 0);
 	if (mtu <= 0)
 	{
 		/* guess MTU as physical MTU - ESP overhead [- NAT-T overhead]
@@ -2540,7 +2540,7 @@ static status_t del_policy(private_kernel_klips_ipsec_t *this,
 static void init_ipsec_devices(private_kernel_klips_ipsec_t *this)
 {
 	int i, count = lib->settings->get_int(lib->settings,
-						"charon.plugins.kernel_klips.ipsec_dev_count",
+						"charon.plugins.kernel-klips.ipsec_dev_count",
 						DEFAULT_IPSEC_DEV_COUNT);
 
 	for (i = 0; i < count; ++i)
diff --git a/src/charon/plugins/load_tester/load_tester_config.c b/src/charon/plugins/load_tester/load_tester_config.c
index c7c609f57..ae3fa8ffa 100644
--- a/src/charon/plugins/load_tester/load_tester_config.c
+++ b/src/charon/plugins/load_tester/load_tester_config.c
@@ -281,32 +281,32 @@ load_tester_config_t *load_tester_config_create()
 
 	this->vip = NULL;
 	if (lib->settings->get_bool(lib->settings,
-				"charon.plugins.load_tester.request_virtual_ip", FALSE))
+				"charon.plugins.load-tester.request_virtual_ip", FALSE))
 	{
 		this->vip = host_create_from_string("0.0.0.0", 0);
 	}
 	this->pool = lib->settings->get_str(lib->settings,
-				"charon.plugins.load_tester.pool", NULL);
+				"charon.plugins.load-tester.pool", NULL);
 	this->remote = lib->settings->get_str(lib->settings,
-				"charon.plugins.load_tester.remote", "127.0.0.1");
+				"charon.plugins.load-tester.remote", "127.0.0.1");
 
 	this->proposal = proposal_create_from_string(PROTO_IKE,
 			lib->settings->get_str(lib->settings,
-				"charon.plugins.load_tester.proposal", "aes128-sha1-modp768"));
+				"charon.plugins.load-tester.proposal", "aes128-sha1-modp768"));
 	if (!this->proposal)
 	{	/* fallback */
 		this->proposal = proposal_create_from_string(PROTO_IKE,
 													 "aes128-sha1-modp768");
 	}
 	this->ike_rekey = lib->settings->get_int(lib->settings,
-				"charon.plugins.load_tester.ike_rekey", 0);
+				"charon.plugins.load-tester.ike_rekey", 0);
 	this->child_rekey = lib->settings->get_int(lib->settings,
-				"charon.plugins.load_tester.child_rekey", 600);
+				"charon.plugins.load-tester.child_rekey", 600);
 
 	this->initiator_auth = lib->settings->get_str(lib->settings,
-				"charon.plugins.load_tester.initiator_auth", "pubkey");
+				"charon.plugins.load-tester.initiator_auth", "pubkey");
 	this->responder_auth = lib->settings->get_str(lib->settings,
-				"charon.plugins.load_tester.responder_auth", "pubkey");
+				"charon.plugins.load-tester.responder_auth", "pubkey");
 
 	this->num = 1;
 	this->peer_cfg = generate_config(this, 0);
diff --git a/src/charon/plugins/load_tester/load_tester_listener.c b/src/charon/plugins/load_tester/load_tester_listener.c
index 0708b35b6..540d4fa4f 100644
--- a/src/charon/plugins/load_tester/load_tester_listener.c
+++ b/src/charon/plugins/load_tester/load_tester_listener.c
@@ -92,7 +92,7 @@ load_tester_listener_t *load_tester_listener_create(u_int shutdown_on)
 	this->public.destroy = (void(*) (load_tester_listener_t*))destroy;
 
 	this->delete_after_established = lib->settings->get_bool(lib->settings,
-				"charon.plugins.load_tester.delete_after_established", FALSE);
+				"charon.plugins.load-tester.delete_after_established", FALSE);
 
 	this->shutdown_on = shutdown_on;
 	this->established = 0;
diff --git a/src/charon/plugins/load_tester/load_tester_plugin.c b/src/charon/plugins/load_tester/load_tester_plugin.c
index d857a4602..63c39b7ee 100644
--- a/src/charon/plugins/load_tester/load_tester_plugin.c
+++ b/src/charon/plugins/load_tester/load_tester_plugin.c
@@ -178,7 +178,7 @@ plugin_t *plugin_create()
 	u_int i, shutdown_on = 0;
 
 	if (!lib->settings->get_bool(lib->settings,
-								 "charon.plugins.load_tester.enable", FALSE))
+								 "charon.plugins.load-tester.enable", FALSE))
 	{
 		DBG1(DBG_CFG, "disabling load-tester plugin, not configured");
 		return NULL;
@@ -191,13 +191,13 @@ plugin_t *plugin_create()
 						(dh_constructor_t)load_tester_diffie_hellman_create);
 
 	this->delay = lib->settings->get_int(lib->settings,
-					"charon.plugins.load_tester.delay", 0);
+					"charon.plugins.load-tester.delay", 0);
 	this->iterations = lib->settings->get_int(lib->settings,
-					"charon.plugins.load_tester.iterations", 1);
+					"charon.plugins.load-tester.iterations", 1);
 	this->initiators = lib->settings->get_int(lib->settings,
-					"charon.plugins.load_tester.initiators", 0);
+					"charon.plugins.load-tester.initiators", 0);
 	if (lib->settings->get_bool(lib->settings,
-					"charon.plugins.load_tester.shutdown_when_complete", 0))
+					"charon.plugins.load-tester.shutdown_when_complete", 0))
 	{
 		shutdown_on = this->iterations * this->initiators;
 	}
@@ -212,7 +212,7 @@ plugin_t *plugin_create()
 	charon->bus->add_listener(charon->bus, &this->listener->listener);
 
 	if (lib->settings->get_bool(lib->settings,
-					"charon.plugins.load_tester.fake_kernel", FALSE))
+					"charon.plugins.load-tester.fake_kernel", FALSE))
 	{
 		charon->kernel_interface->add_ipsec_interface(charon->kernel_interface,
 						(kernel_ipsec_constructor_t)load_tester_ipsec_create);
diff --git a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/strongswan.conf
index e2494922b..9f3c6bfa3 100644
--- a/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/strongswan.conf
+++ b/testing/tests/ikev2/mult-auth-rsa-eap-sim-id/hosts/moon/etc/strongswan.conf
@@ -3,8 +3,8 @@
 charon {
   load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink fips-prf eap-radius eap-identity updown
   plugins {
-    eap_radius {
-      secret = gv6URkSs 
+    eap-radius {
+      secret = gv6URkSs
       server = PH_IP_ALICE
     }
   }
diff --git a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/strongswan.conf
index e2494922b..9f3c6bfa3 100644
--- a/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/strongswan.conf
+++ b/testing/tests/ikev2/rw-eap-md5-id-radius/hosts/moon/etc/strongswan.conf
@@ -3,8 +3,8 @@
 charon {
   load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink fips-prf eap-radius eap-identity updown
   plugins {
-    eap_radius {
-      secret = gv6URkSs 
+    eap-radius {
+      secret = gv6URkSs
       server = PH_IP_ALICE
     }
   }
diff --git a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/strongswan.conf b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/strongswan.conf
index e2494922b..9f3c6bfa3 100644
--- a/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/strongswan.conf
+++ b/testing/tests/ikev2/rw-eap-sim-id-radius/hosts/moon/etc/strongswan.conf
@@ -3,8 +3,8 @@
 charon {
   load = curl aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink fips-prf eap-radius eap-identity updown
   plugins {
-    eap_radius {
-      secret = gv6URkSs 
+    eap-radius {
+      secret = gv6URkSs
       server = PH_IP_ALICE
     }
   }