diff --git a/unmaintained/diff_volume_servers/diff_volume_servers.go b/unmaintained/diff_volume_servers/diff_volume_servers.go
index 698d7dd3b..9433af147 100644
--- a/unmaintained/diff_volume_servers/diff_volume_servers.go
+++ b/unmaintained/diff_volume_servers/diff_volume_servers.go
@@ -41,7 +41,7 @@ var (
 func main() {
 	flag.Parse()
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption = security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	vid := uint32(*volumeId)
diff --git a/unmaintained/repeated_vacuum/repeated_vacuum.go b/unmaintained/repeated_vacuum/repeated_vacuum.go
index 893f4a68a..65ec94627 100644
--- a/unmaintained/repeated_vacuum/repeated_vacuum.go
+++ b/unmaintained/repeated_vacuum/repeated_vacuum.go
@@ -26,7 +26,7 @@ var (
 func main() {
 	flag.Parse()
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	genFile(grpcDialOption, 0)
diff --git a/unmaintained/stream_read_volume/stream_read_volume.go b/unmaintained/stream_read_volume/stream_read_volume.go
index cdbfa2c44..2737962f2 100644
--- a/unmaintained/stream_read_volume/stream_read_volume.go
+++ b/unmaintained/stream_read_volume/stream_read_volume.go
@@ -24,7 +24,7 @@ var (
 func main() {
 	flag.Parse()
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption = security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	vid := uint32(*volumeId)
diff --git a/unmaintained/volume_tailer/volume_tailer.go b/unmaintained/volume_tailer/volume_tailer.go
index 50ef1c74f..c210db81f 100644
--- a/unmaintained/volume_tailer/volume_tailer.go
+++ b/unmaintained/volume_tailer/volume_tailer.go
@@ -25,7 +25,7 @@ var (
 func main() {
 	flag.Parse()
 
-	util2.LoadConfiguration("security", false)
+	util2.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util2.GetViper(), "grpc.client")
 
 	vid := needle.VolumeId(*volumeId)
diff --git a/weed/command/backup.go b/weed/command/backup.go
index a8be4838e..3573dbbfd 100644
--- a/weed/command/backup.go
+++ b/weed/command/backup.go
@@ -66,7 +66,7 @@ var cmdBackup = &Command{
 
 func runBackup(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	if *s.volumeId == -1 {
diff --git a/weed/command/benchmark.go b/weed/command/benchmark.go
index 2a0db47c2..0cd9d31c5 100644
--- a/weed/command/benchmark.go
+++ b/weed/command/benchmark.go
@@ -111,7 +111,7 @@ var (
 
 func runBenchmark(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	b.grpcDialOption = security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	fmt.Printf("This is SeaweedFS version %s %s %s\n", util.Version(), runtime.GOOS, runtime.GOARCH)
diff --git a/weed/command/download.go b/weed/command/download.go
index 060be9f14..1032dcb62 100644
--- a/weed/command/download.go
+++ b/weed/command/download.go
@@ -47,7 +47,7 @@ var cmdDownload = &Command{
 }
 
 func runDownload(cmd *Command, args []string) bool {
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	for _, fid := range args {
diff --git a/weed/command/filer.go b/weed/command/filer.go
index 2554b3477..dcb7be36b 100644
--- a/weed/command/filer.go
+++ b/weed/command/filer.go
@@ -178,7 +178,7 @@ func runFiler(cmd *Command, args []string) bool {
 		go http.ListenAndServe(fmt.Sprintf(":%d", *f.debugPort), nil)
 	}
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 
 	switch {
 	case *f.metricsHttpIp != "":
diff --git a/weed/command/filer_backup.go b/weed/command/filer_backup.go
index a66c53f8e..1344dfd2c 100644
--- a/weed/command/filer_backup.go
+++ b/weed/command/filer_backup.go
@@ -59,7 +59,7 @@ var cmdFilerBackup = &Command{
 
 func runFilerBackup(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	util.LoadConfiguration("replication", true)
 
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
diff --git a/weed/command/filer_cat.go b/weed/command/filer_cat.go
index 2ef3bfc33..ba3625b0d 100644
--- a/weed/command/filer_cat.go
+++ b/weed/command/filer_cat.go
@@ -59,7 +59,7 @@ var cmdFilerCat = &Command{
 
 func runFilerCat(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 
 	if len(args) == 0 {
 		return false
diff --git a/weed/command/filer_copy.go b/weed/command/filer_copy.go
index df5e002c5..59cd5491d 100644
--- a/weed/command/filer_copy.go
+++ b/weed/command/filer_copy.go
@@ -83,7 +83,7 @@ var cmdFilerCopy = &Command{
 
 func runCopy(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 
 	if len(args) <= 1 {
 		return false
diff --git a/weed/command/filer_meta_backup.go b/weed/command/filer_meta_backup.go
index 6ed8c4c64..e8c4680ba 100644
--- a/weed/command/filer_meta_backup.go
+++ b/weed/command/filer_meta_backup.go
@@ -56,7 +56,7 @@ The backup writes to another filer store specified in a backup_filer.toml.
 
 func runFilerMetaBackup(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	metaBackup.grpcDialOption = security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	// load backup_filer.toml
diff --git a/weed/command/filer_meta_tail.go b/weed/command/filer_meta_tail.go
index 32855072b..d7a169535 100644
--- a/weed/command/filer_meta_tail.go
+++ b/weed/command/filer_meta_tail.go
@@ -45,7 +45,7 @@ var (
 
 func runFilerMetaTail(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 	clientId := util.RandomInt32()
 
diff --git a/weed/command/filer_remote_gateway.go b/weed/command/filer_remote_gateway.go
index 61a5d26a2..78357cc04 100644
--- a/weed/command/filer_remote_gateway.go
+++ b/weed/command/filer_remote_gateway.go
@@ -78,7 +78,7 @@ var cmdFilerRemoteGateway = &Command{
 
 func runFilerRemoteGateway(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 	remoteGatewayOptions.grpcDialOption = grpcDialOption
 
diff --git a/weed/command/filer_remote_sync.go b/weed/command/filer_remote_sync.go
index 2d6133367..77dd95134 100644
--- a/weed/command/filer_remote_sync.go
+++ b/weed/command/filer_remote_sync.go
@@ -73,7 +73,7 @@ var cmdFilerRemoteSynchronize = &Command{
 
 func runFilerRemoteSynchronize(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 	remoteSyncOptions.grpcDialOption = grpcDialOption
 
diff --git a/weed/command/filer_replication.go b/weed/command/filer_replication.go
index 4fca8158a..f53fdfb48 100644
--- a/weed/command/filer_replication.go
+++ b/weed/command/filer_replication.go
@@ -30,7 +30,7 @@ var cmdFilerReplicate = &Command{
 
 func runFilerReplicate(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	util.LoadConfiguration("replication", true)
 	util.LoadConfiguration("notification", true)
 	config := util.GetViper()
diff --git a/weed/command/filer_sync.go b/weed/command/filer_sync.go
index 9d29b6fee..c246f6b74 100644
--- a/weed/command/filer_sync.go
+++ b/weed/command/filer_sync.go
@@ -118,7 +118,7 @@ var cmdFilerSynchronize = &Command{
 
 func runFilerSynchronize(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	grace.SetupProfiling(*syncCpuProfile, *syncMemProfile)
diff --git a/weed/command/iam.go b/weed/command/iam.go
index 95964994f..fa21803dd 100644
--- a/weed/command/iam.go
+++ b/weed/command/iam.go
@@ -47,7 +47,7 @@ func runIam(cmd *Command, args []string) bool {
 func (iamopt *IamOptions) startIamServer() bool {
 	filerAddress := pb.ServerAddress(*iamopt.filer)
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 	for {
 		err := pb.WithGrpcFilerClient(false, 0, filerAddress, grpcDialOption, func(client filer_pb.SeaweedFilerClient) error {
diff --git a/weed/command/master.go b/weed/command/master.go
index 7eecdb571..914853d88 100644
--- a/weed/command/master.go
+++ b/weed/command/master.go
@@ -105,7 +105,7 @@ var (
 
 func runMaster(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	util.LoadConfiguration("master", false)
 
 	grace.SetupProfiling(*masterCpuProfile, *masterMemProfile)
diff --git a/weed/command/master_follower.go b/weed/command/master_follower.go
index 7217aff0b..504ddb6c3 100644
--- a/weed/command/master_follower.go
+++ b/weed/command/master_follower.go
@@ -68,7 +68,7 @@ var cmdMasterFollower = &Command{
 
 func runMasterFollower(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	util.LoadConfiguration("master", false)
 
 	if *mf.portGrpc == 0 {
diff --git a/weed/command/mount_std.go b/weed/command/mount_std.go
index 742c38180..a5325b11e 100644
--- a/weed/command/mount_std.go
+++ b/weed/command/mount_std.go
@@ -66,7 +66,7 @@ func RunMount(option *MountOptions, umask os.FileMode) bool {
 
 	// try to connect to filer
 	filerAddresses := pb.ServerAddresses(*option.filer).ToAddresses()
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 	var cipher bool
 	var err error
diff --git a/weed/command/mq_broker.go b/weed/command/mq_broker.go
index e093ebc56..5eb304204 100644
--- a/weed/command/mq_broker.go
+++ b/weed/command/mq_broker.go
@@ -54,7 +54,7 @@ var cmdMqBroker = &Command{
 
 func runMqBroker(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 
 	mqBrokerStandaloneOptions.masters = pb.ServerAddresses(*mqBrokerStandaloneOptions.mastersString).ToAddressMap()
 
diff --git a/weed/command/s3.go b/weed/command/s3.go
index f71f2dc93..0575cfa58 100644
--- a/weed/command/s3.go
+++ b/weed/command/s3.go
@@ -165,7 +165,7 @@ var cmdS3 = &Command{
 
 func runS3(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 
 	switch {
 	case *s3StandaloneOptions.metricsHttpIp != "":
diff --git a/weed/command/server.go b/weed/command/server.go
index 64bd935db..ddcaf1f7e 100644
--- a/weed/command/server.go
+++ b/weed/command/server.go
@@ -179,7 +179,7 @@ func runServer(cmd *Command, args []string) bool {
 		go http.ListenAndServe(fmt.Sprintf(":%d", *serverOptions.debugPort), nil)
 	}
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	util.LoadConfiguration("master", false)
 
 	grace.SetupProfiling(*serverOptions.cpuprofile, *serverOptions.memprofile)
diff --git a/weed/command/shell.go b/weed/command/shell.go
index f78ba89fc..1e921411b 100644
--- a/weed/command/shell.go
+++ b/weed/command/shell.go
@@ -35,7 +35,7 @@ var cmdShell = &Command{
 
 func runShell(command *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	shellOptions.GrpcDialOption = security.LoadClientTLS(util.GetViper(), "grpc.client")
 	shellOptions.Directory = "/"
 
diff --git a/weed/command/upload.go b/weed/command/upload.go
index 3e6b8f9a2..7135a707a 100644
--- a/weed/command/upload.go
+++ b/weed/command/upload.go
@@ -69,7 +69,7 @@ var cmdUpload = &Command{
 
 func runUpload(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 	grpcDialOption := security.LoadClientTLS(util.GetViper(), "grpc.client")
 
 	defaultReplication, err := readMasterConfiguration(grpcDialOption, pb.ServerAddress(*upload.master))
diff --git a/weed/command/volume.go b/weed/command/volume.go
index 4bd7668d5..1078d8d6c 100644
--- a/weed/command/volume.go
+++ b/weed/command/volume.go
@@ -125,7 +125,7 @@ var (
 
 func runVolume(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 
 	// If --pprof is set we assume the caller wants to be able to collect
 	// cpu and memory profiles via go tool pprof
diff --git a/weed/command/webdav.go b/weed/command/webdav.go
index f0e738f4a..1d1a43eda 100644
--- a/weed/command/webdav.go
+++ b/weed/command/webdav.go
@@ -60,7 +60,7 @@ var cmdWebDav = &Command{
 
 func runWebDav(cmd *Command, args []string) bool {
 
-	util.LoadConfiguration("security", false)
+	util.LoadSecurityConfiguration()
 
 	glog.V(0).Infof("Starting Seaweed WebDav Server %s at https port %d", util.Version(), *webDavStandaloneOptions.port)
 
diff --git a/weed/util/config.go b/weed/util/config.go
index a242742fc..7ac765ff5 100644
--- a/weed/util/config.go
+++ b/weed/util/config.go
@@ -11,6 +11,7 @@ import (
 
 var (
 	ConfigurationFileDirectory DirectoryValueType
+	loadSecurityConfigOnce sync.Once
 )
 
 type DirectoryValueType string
@@ -31,6 +32,12 @@ type Configuration interface {
 	SetDefault(key string, value interface{})
 }
 
+func LoadSecurityConfiguration(){
+	loadSecurityConfigOnce.Do(func() {
+		LoadConfiguration("security", false)
+	})
+}
+
 func LoadConfiguration(configFileName string, required bool) (loaded bool) {
 
 	// find a filer store