diff --git a/bin/goldilocks.js b/bin/goldilocks.js
index eacacd4..dd2907a 100755
--- a/bin/goldilocks.js
+++ b/bin/goldilocks.js
@@ -67,6 +67,23 @@ function fixRawConfig(config) {
     updateDomains(config[key].domains);
   });
 
+  if (config.tcp && config.tcp && !Array.isArray(config.tcp)) {
+    config.tcp.bind = [ config.tcp.bind ];
+    updated = true;
+  }
+  if (config.http && config.http.bind) {
+    config.tcp = config.tcp || { bind: [] };
+    config.tcp.bind = (config.tcp.bind || []).concat(config.http.bind);
+    delete config.http.bind;
+    updated = true;
+  }
+  if (config.tls && config.tls.bind) {
+    config.tcp = config.tcp || { bind: [] };
+    config.tcp.bind = (config.tcp.bind || []).concat(config.tls.bind);
+    delete config.tls.bind;
+    updated = true;
+  }
+
   if (config.dns) {
     config.udp = config.dns;
     delete config.dns;
diff --git a/lib/admin/config.js b/lib/admin/config.js
index 09d7a08..e45a3c2 100644
--- a/lib/admin/config.js
+++ b/lib/admin/config.js
@@ -101,7 +101,9 @@ var httpSchema = {
     primary_domain: { type: 'string' }
   , allow_insecure: { type: 'boolean' }
   , trust_proxy:    { type: 'boolean' }
-, }
+
+  , bind: { not: {} } // this is a forbidden deprecated setting.
+  }
 };
 addDomainsSchema(httpSchema, ['proxy', 'static', 'redirect']);
 
@@ -117,6 +119,8 @@ var tlsSchema = {
       , server:           { type: 'string' }
       , challenge_type:   { type: 'string' }
       , approved_domains: { type: 'array', items: { type: 'string' }, minLength: 1}
+
+      , bind: { not: {} } // this is a forbidden deprecated setting.
       }
     }
   }
diff --git a/lib/goldilocks.js b/lib/goldilocks.js
index 14c5f25..917a5bb 100644
--- a/lib/goldilocks.js
+++ b/lib/goldilocks.js
@@ -197,21 +197,10 @@ module.exports.create = function (deps, config) {
 
   var listenPromises = [];
   var tcpPortMap = {};
-  function addPorts(bindList) {
-    if (!bindList) {
-      return;
-    }
-    if (Array.isArray(bindList)) {
-      bindList.filter(Number).forEach(function (port) {
-        tcpPortMap[port] = true;
-      });
-    }
-    else if (Number(bindList)) {
-      tcpPortMap[bindList] = true;
-    }
-  }
+  config.tcp.bind.filter(Number).forEach(function (port) {
+    tcpPortMap[port] = true;
+  });
 
-  addPorts(config.tcp.bind);
   (config.tcp.modules || []).forEach(function (mod) {
     if (mod.type === 'forward') {
       var forwarder = createTcpForwarder(mod);
@@ -229,12 +218,6 @@ module.exports.create = function (deps, config) {
     }
   });
 
-  // Even though these ports were specified in different places we treat any TCP
-  // connections we haven't been told to just forward exactly as is equal so that
-  // we can potentially use the same ports for different protocols.
-  addPorts(config.tls.bind);
-  addPorts(config.http.bind);
-
   var portList = Object.keys(tcpPortMap).map(Number).sort();
   portList.forEach(function (port) {
     listenPromises.push(listeners.tcp.add(port, netHandler));