diff --git a/CMakeLists.txt b/CMakeLists.txt
index bb4ddc34b8553f9fd9f78d7707ac4706d56f2214..901120436b2d562741ee239890a2dc65a6d38aea 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -31,7 +31,12 @@ project(libcaosdb
     DESCRIPTION "C and C++ client libraries for CaosDB"
     LANGUAGES CXX C)
 
+set(CMAKE_C_STANDARD 99)
 set(CMAKE_CXX_STANDARD 17)
+
+set(CMAKE_C_EXTENSIONS OFF)
+set(CMAKE_C_STANDARD_REQUIRED ON)
+set(CMAKE_CXX_EXTENSIONS OFF)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
 set(CMAKE_MODULE_PATH "${PROJECT_SOURCE_DIR}/cmake" ${CMAKE_MODULE_PATH})
@@ -193,6 +198,39 @@ target_link_libraries(cxxcaosdbcli
 ### LINTING with CLANG-TIDY and INCLUDE-WHAT-YOU-USE
 #######################################################
 
+###########################################
+### PARANOID COMPILER SETTINGS
+###########################################
+option(PARANOID_COMPILER_SETTINGS "Enable extra-paranoid compiler settings
+(which may even flag errors for code in the dependencies. These only apply in
+Debug BUILD_TYPE with SKIP_LINTING=Off or when LINTING=On." OFF)
+include(CheckCXXCompilerFlag)
+include(CheckCCompilerFlag)
+
+function(add_compiler_flag flag)
+    string(FIND "${CMAKE_CXX_FLAGS}" "${flag}" cxx_present)
+    if(cxx_present EQUAL -1)
+        check_cxx_compiler_flag("${flag}" flag_supported)
+        if(flag_supported)
+            set(PEDANTIC_CMAKE_CXX_FLAGS "${PEDANTIC_CMAKE_CXX_FLAGS} ${flag}" PARENT_SCOPE)
+        endif()
+        unset(flag_supported CACHE)
+    endif()
+    unset(cxx_present CACHE)
+
+    string(FIND "${CMAKE_C_FLAGS}" "${flag}" c_present)
+    if(c_present EQUAL -1)
+        check_cxx_compiler_flag("${flag}" flag_supported)
+        if(flag_supported)
+            set(PEDANTIC_CMAKE_C_FLAGS "${PEDANTIC_CMAKE_C_FLAGS} ${flag}" PARENT_SCOPE)
+        endif()
+        unset(flag_supported CACHE)
+    endif()
+    unset(c_present CACHE)
+endfunction()
+
+
+
 option(LINTING "Enable linting with clang-tidy and iwyu when in non-Debug build-type" OFF)
 if("${CMAKE_BUILD_TYPE}" MATCHES "Debug" OR LINTING)
     set(_LINTING ON)
@@ -203,6 +241,27 @@ if("${CMAKE_BUILD_TYPE}" MATCHES "Debug" AND SKIP_LINTING)
     set(_LINTING OFF)
 endif()
 if(_LINTING)
+
+    ### set paranoid compiler flags
+    add_compiler_flag("-Wall")
+    add_compiler_flag("-Wextra")
+    add_compiler_flag("-pedantic")
+    add_compiler_flag("-Werror")
+
+    set(TARGET_CAOSDB_COMPILE_FLAGS "${TARGET_CAOSDB_COMPILE_FLAGS} ${PEDANTIC_CMAKE_CXX_FLAGS}")
+    set(TARGET_CCAOSDB_COMPILE_FLAGS "${TARGET_CCAOSDB_COMPILE_FLAGS} ${PEDANTIC_CMAKE_C_FLAGS}")
+    set(TARGET_CXXCAOSDBCLI_COMPILE_FLAGS "${TARGET_CXXCAOSDBCLI_COMPILE_FLAGS} ${PEDANTIC_CMAKE_CXX_FLAGS}")
+    set(TARGET_CCAOSDBCLI_COMPILE_FLAGS "${TARGET_CCAOSDBCLI_COMPILE_FLAGS} ${PEDANTIC_CMAKE_C_FLAGS}")
+
+    set_target_properties(caosdb PROPERTIES
+        COMPILE_FLAGS "${TARGET_CAOSDB_COMPILE_FLAGS}")
+    set_target_properties(ccaosdb PROPERTIES
+        COMPILE_FLAGS "${TARGET_CCAOSDB_COMPILE_FLAGS}")
+    set_target_properties(cxxcaosdbcli PROPERTIES
+        COMPILE_FLAGS "${TARGET_CXXCAOSDBCLI_COMPILE_FLAGS}")
+    set_target_properties(ccaosdbcli PROPERTIES
+        COMPILE_FLAGS "${TARGET_CCAOSDBCLI_COMPILE_FLAGS}")
+
     find_program(iwyu
         NAMES include-what-you-use iwyu
         PATHS ${CMAKE_SOURCE_DIR}/tools/include-what-you-use/${iwyu_os}/bin)
@@ -230,10 +289,12 @@ if(_LINTING)
     else()
         message(STATUS "clang-tidy: ${clang_tidy}")
         set(_CMAKE_CXX_CLANG_TIDY_CHECKS
-            "--checks=*,-fuchsia-*,-llvm-include-order,-llvmlibc-*,-readability-convert-member-functions-to-static,-cppcoreguidelines-pro-bounds-array-to-pointer-decay,-hicpp-no-array-decay,-llvm-else-after-return,-readability-else-after-return")
+            "--checks=*,-fuchsia-*,-llvmlibc-*,-readability-convert-member-functions-to-static,-cppcoreguidelines-pro-bounds-array-to-pointer-decay,-hicpp-no-array-decay,-llvm-else-after-return,-readability-else-after-return")
+        set(_CMAKE_C_CLANG_TIDY_CHECKS "${_CMAKE_CXX_CLANG_TIDY_CHECKS}")
         set(_CMAKE_CXX_CLANG_TIDY "${clang_tidy}"
             "--header-filter=caosdb/.*[^\(\.pb\.h\)]$"
             "--warnings-as-errors=*")
+        set(_CMAKE_C_CLANG_TIDY "${_CMAKE_CXX_CLANG_TIDY}")
         option(AUTO_FIX_LINTING "Append --fix option to clang-tidy" OFF)
         if(AUTO_FIX_LINTING)
             set(_CMAKE_CXX_CLANG_TIDY "${_CMAKE_CXX_CLANG_TIDY};--fix")
@@ -246,8 +307,11 @@ if(_LINTING)
         set_target_properties(cxxcaosdbcli PROPERTIES
             CXX_CLANG_TIDY "${_CMAKE_CXX_CLANG_TIDY};${_CMAKE_CXX_CLANG_TIDY_CHECKS}"
             )
+        set_target_properties(ccaosdb PROPERTIES
+            C_CLANG_TIDY "${_CMAKE_C_CLANG_TIDY};${_CMAKE_C_CLANG_TIDY_CHECKS}"
+            )
         set_target_properties(ccaosdbcli PROPERTIES
-            C_CLANG_TIDY "${_CMAKE_CXX_CLANG_TIDY};${_CMAKE_CXX_CLANG_TIDY_CHECKS}"
+            C_CLANG_TIDY "${_CMAKE_C_CLANG_TIDY};${_CMAKE_C_CLANG_TIDY_CHECKS}"
             )
     endif()
 endif()
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index 48f470b38e022dd9deb7c00bf53a09ac62091076..51afe439da1a1237dbbb73ac94c15177f37c03cc 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -21,6 +21,7 @@
 # add all header files to this list
 set(libcaosdb_INCL
     ${CMAKE_CURRENT_SOURCE_DIR}/caosdb/authentication.h
+    ${CMAKE_CURRENT_SOURCE_DIR}/caosdb/certificate_provider.h
     ${CMAKE_CURRENT_SOURCE_DIR}/caosdb/configuration.h
     ${CMAKE_CURRENT_SOURCE_DIR}/caosdb/connection.h
     ${CMAKE_CURRENT_BINARY_DIR}/caosdb/constants.h
diff --git a/include/caosdb/authentication.h b/include/caosdb/authentication.h
index 8071414ef436619def4caf6881ebca027b757a60..fc2420c5dc3100682a16eefb56494a63e64e8162 100644
--- a/include/caosdb/authentication.h
+++ b/include/caosdb/authentication.h
@@ -27,16 +27,15 @@
  * @date 2021-06-28
  * @brief Configuration and setup of the client authentication.
  */
-
-#include <grpcpp/security/credentials.h>               // for CallCredentials
-#include <map>                                         // for multimap
-#include <memory>                                      // for shared_ptr
-#include <string>                                      // for string
 #include "caosdb/utility.h"                            // for base64_encode
 #include "grpcpp/impl/codegen/interceptor.h"           // for Status
 #include "grpcpp/impl/codegen/security/auth_context.h" // for AuthContext
 #include "grpcpp/impl/codegen/status.h"                // for Status
 #include "grpcpp/impl/codegen/string_ref.h"            // for string_ref
+#include <grpcpp/security/credentials.h>               // for CallCredentials
+#include <map>                                         // for multimap
+#include <memory>                                      // for shared_ptr
+#include <string>                                      // for string
 
 namespace caosdb {
 namespace authentication {
diff --git a/include/caosdb/certificate_provider.h b/include/caosdb/certificate_provider.h
new file mode 100644
index 0000000000000000000000000000000000000000..e7d7a156efeaf05435fd3ccb8029549a82e38442
--- /dev/null
+++ b/include/caosdb/certificate_provider.h
@@ -0,0 +1,53 @@
+/*
+ * This file is a part of the CaosDB Project.
+ *
+ * Copyright (C) 2021 Timm Fitschen <t.fitschen@indiscale.com>
+ * Copyright (C) 2021 IndiScale GmbH <info@indiscale.com>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ *
+ */
+
+#ifndef CAOSDB_CERTIFICATE_PROVIDER_H
+#define CAOSDB_CERTIFICATE_PROVIDER_H
+
+#include "boost/filesystem/path.hpp" // for path
+namespace caosdb::configuration {
+using boost::filesystem::path;
+
+class CertificateProvider {
+public:
+  [[nodiscard]] auto virtual GetCertificatePem() const -> std::string = 0;
+  virtual ~CertificateProvider() = default;
+};
+
+class PemFileCertificateProvider : public CertificateProvider {
+private:
+  std::string certificate_provider;
+
+public:
+  explicit PemFileCertificateProvider(const path &path);
+  [[nodiscard]] auto GetCertificatePem() const -> std::string override;
+};
+
+class PemCertificateProvider : public CertificateProvider {
+private:
+  std::string certificate_provider;
+
+public:
+  explicit PemCertificateProvider(const std::string &certificate_provider);
+  [[nodiscard]] auto GetCertificatePem() const -> std::string override;
+};
+} // namespace caosdb::configuration
+#endif
diff --git a/include/caosdb/configuration.h b/include/caosdb/configuration.h
index 6a59880964f4cec402998e11529b60d459bdc338..f6f207574efee6cc611dd6e50b7dd1dd1995a2eb 100644
--- a/include/caosdb/configuration.h
+++ b/include/caosdb/configuration.h
@@ -21,17 +21,19 @@
 
 #ifndef CAOSDB_CONFIGURATION_H
 #define CAOSDB_CONFIGURATION_H
-#include <memory>                          // for unique_ptr
-#include <string>                          // for string
 #include "boost/filesystem/operations.hpp" // for exists
 #include "boost/filesystem/path.hpp"       // for path
 #include "boost/json/object.hpp"           // for object
 #include "boost/json/value.hpp"            // for value
-#include "boost/json/value_ref.hpp"        // for array, object
+#include "boost/json/value_ref.hpp"        // IWYU pragma: keep
 #include "caosdb/authentication.h"         // for Authenticator, PlainPassw...
-#include "caosdb/connection.h" // for ConnectionConfiguration, Certifi...
-#include "caosdb/exceptions.h" // for ConfigurationError
-#include "caosdb/utility.h"    // for load_json_file
+#include "caosdb/certificate_provider.h"   // for CertificateProvider, path
+#include "caosdb/exceptions.h"             // for ConfigurationError
+#include "caosdb/utility.h"                // for load_json_file
+#include "grpcpp/security/credentials.h"   // for ChannelCredentials
+#include <iosfwd>                          // for ostream
+#include <memory>                          // for unique_ptr, shared_ptr
+#include <string>                          // for string
 
 namespace caosdb::configuration {
 using boost::filesystem::exists;
@@ -41,14 +43,61 @@ using boost::json::object;
 using boost::json::value;
 using caosdb::authentication::Authenticator;
 using caosdb::authentication::PlainPasswordAuthenticator;
-using caosdb::connection::CertificateProvider;
-using caosdb::connection::ConnectionConfiguration;
-using caosdb::connection::ConnectionManager;
-using caosdb::connection::InsecureConnectionConfiguration;
-using caosdb::connection::PemFileCertificateProvider;
-using caosdb::connection::TlsConnectionConfiguration;
 using caosdb::exceptions::ConfigurationError;
 using caosdb::utility::load_json_file;
+using grpc::ChannelCredentials;
+
+/**
+ * @brief Configuration of the CaosDB connection.
+ */
+class ConnectionConfiguration {
+private:
+  std::string host;
+  int port;
+
+public:
+  ConnectionConfiguration(const std::string &host, int port);
+  virtual ~ConnectionConfiguration() = default;
+  friend auto operator<<(std::ostream &out,
+                         const ConnectionConfiguration &configuration)
+    -> std::ostream &;
+
+  [[nodiscard]] auto virtual ToString() const -> std::string = 0;
+  [[nodiscard]] auto GetHost() const -> std::string;
+  [[nodiscard]] auto GetPort() const -> int;
+  [[nodiscard]] auto virtual GetChannelCredentials() const
+    -> std::shared_ptr<ChannelCredentials> = 0;
+};
+
+class InsecureConnectionConfiguration : public ConnectionConfiguration {
+private:
+  std::shared_ptr<ChannelCredentials> credentials;
+
+public:
+  InsecureConnectionConfiguration(const std::string &host, int port);
+  [[nodiscard]] auto GetChannelCredentials() const
+    -> std::shared_ptr<ChannelCredentials> override;
+  [[nodiscard]] auto ToString() const -> std::string override;
+};
+
+class TlsConnectionConfiguration : public ConnectionConfiguration {
+private:
+  std::shared_ptr<ChannelCredentials> credentials;
+  std::string certificate_provider;
+
+public:
+  TlsConnectionConfiguration(const std::string &host, int port);
+  TlsConnectionConfiguration(const std::string &host, int port,
+                             const Authenticator &authenticator);
+  TlsConnectionConfiguration(const std::string &host, int port,
+                             const CertificateProvider &certificate_provider);
+  TlsConnectionConfiguration(const std::string &host, int port,
+                             const CertificateProvider &certificate_provider,
+                             const Authenticator &authenticator);
+  [[nodiscard]] auto GetChannelCredentials() const
+    -> std::shared_ptr<ChannelCredentials> override;
+  [[nodiscard]] auto ToString() const -> std::string override;
+};
 
 /**
  * Helper class (no state, just member functions) which should only be used by
diff --git a/include/caosdb/connection.h b/include/caosdb/connection.h
index abe53fb04d28256be9a6c7ebec149f7eb5196b40..5fad0d26c69b9b10b1739a0f1322a9f3b3485509 100644
--- a/include/caosdb/connection.h
+++ b/include/caosdb/connection.h
@@ -27,96 +27,27 @@
  * @date 2021-05-18
  * @brief Configuration and setup of the connection.
  */
-#include <iosfwd>                                // for ostream
-#include <map>                                   // for map
-#include <memory>                                // for shared_ptr, unique_ptr
-#include <string>                                // for string, basic_string
+#include "boost/filesystem/path.hpp"             // for path
 #include "caosdb/authentication.h"               // for Authenticator
+#include "caosdb/configuration.h"                // for ConnectionConfigura...
 #include "caosdb/entity/v1alpha1/main.grpc.pb.h" // for EntityTransactionSe...
 #include "caosdb/info.h"                         // for VersionInfo
 #include "caosdb/info/v1alpha1/main.grpc.pb.h"   // for GeneralInfoService:...
 #include "caosdb/transaction.h"                  // for Transaction
 #include "grpcpp/channel.h"                      // for Channel
-#include "grpcpp/security/credentials.h"         // for ChannelCredentials
+#include <iosfwd>                                // for ostream
+#include <map>                                   // for map
+#include <memory>                                // for shared_ptr, unique_ptr
+#include <string>                                // for string, basic_string
 
 namespace caosdb::connection {
+using boost::filesystem::path;
 using caosdb::authentication::Authenticator;
+using caosdb::configuration::ConnectionConfiguration;
 using caosdb::entity::v1alpha1::EntityTransactionService;
 using caosdb::info::VersionInfo;
 using caosdb::info::v1alpha1::GeneralInfoService;
 using caosdb::transaction::Transaction;
-using caosdb::transaction::TransactionStatus;
-using grpc::ChannelCredentials;
-
-class CertificateProvider {
-public:
-  [[nodiscard]] auto virtual GetCertificatePem() const -> std::string = 0;
-  virtual ~CertificateProvider() = default;
-};
-
-class PemFileCertificateProvider : public CertificateProvider {
-private:
-  std::string certificate_provider;
-
-public:
-  explicit PemFileCertificateProvider(const std::string &path);
-  [[nodiscard]] auto GetCertificatePem() const -> std::string override;
-};
-
-class PemCertificateProvider : public CertificateProvider {
-private:
-  std::string certificate_provider;
-
-public:
-  explicit PemCertificateProvider(const std::string &certificate_provider);
-  [[nodiscard]] auto GetCertificatePem() const -> std::string override;
-};
-
-/**
- * @brief Configuration of the CaosDB connection.
- */
-class ConnectionConfiguration {
-private:
-  std::string host;
-  int port;
-
-public:
-  ConnectionConfiguration(const std::string &host, int port);
-  virtual ~ConnectionConfiguration() = default;
-
-  [[nodiscard]] auto GetHost() const -> std::string;
-  [[nodiscard]] auto GetPort() const -> int;
-  [[nodiscard]] auto virtual GetChannelCredentials() const
-    -> std::shared_ptr<ChannelCredentials> = 0;
-};
-
-class InsecureConnectionConfiguration : public ConnectionConfiguration {
-private:
-  std::shared_ptr<ChannelCredentials> credentials;
-
-public:
-  InsecureConnectionConfiguration(const std::string &host, int port);
-  [[nodiscard]] auto GetChannelCredentials() const
-    -> std::shared_ptr<ChannelCredentials> override;
-};
-
-class TlsConnectionConfiguration : public ConnectionConfiguration {
-private:
-  std::shared_ptr<ChannelCredentials> credentials;
-  std::string certificate_provider;
-
-public:
-  TlsConnectionConfiguration(const std::string &host, int port);
-  TlsConnectionConfiguration(const std::string &host, int port,
-                             const Authenticator &authenticator);
-  TlsConnectionConfiguration(const std::string &host, int port,
-                             const CertificateProvider &certificate_provider);
-  TlsConnectionConfiguration(const std::string &host, int port,
-                             const CertificateProvider &certificate_provider,
-                             const Authenticator &authenticator);
-  [[nodiscard]] auto GetChannelCredentials() const
-    -> std::shared_ptr<ChannelCredentials> override;
-};
 
 /**
  * @brief A reusable connection to a CaosDBServer.
diff --git a/include/caosdb/entity.h b/include/caosdb/entity.h
index e98b852ea0ca63758ed0e9bd68cf039d0f728d1a..f25b6dc3e7af69d088cbfe4c5b3356b806d12dc6 100644
--- a/include/caosdb/entity.h
+++ b/include/caosdb/entity.h
@@ -28,9 +28,9 @@
 #ifndef CAOSDB_ENTITY_H
 #define CAOSDB_ENTITY_H
 
+#include "caosdb/entity/v1alpha1/main.pb.h" // for Entity, RepeatedField
 #include <memory>                           // for unique_ptr
 #include <string>                           // for string
-#include "caosdb/entity/v1alpha1/main.pb.h" // for Entity, RepeatedField
 
 namespace caosdb::entity {
 
diff --git a/include/caosdb/info.h b/include/caosdb/info.h
index f4f290b1ebde4a5ef89aaf8ecef9017b822296ba..751539eeeb95800bc76aba0cb59de5f5b106f5b2 100644
--- a/include/caosdb/info.h
+++ b/include/caosdb/info.h
@@ -27,9 +27,9 @@
  * @date 2021-07-02
  * @brief General information about the CaosDBServer.
  */
+#include "caosdb/info/v1alpha1/main.pb.h" // for VersionInfo
 #include <cstdint>                        // for uint32_t
 #include <string>                         // for string
-#include "caosdb/info/v1alpha1/main.pb.h" // for VersionInfo
 
 namespace caosdb::info {
 
diff --git a/include/caosdb/transaction.h b/include/caosdb/transaction.h
index 0f9749534b57e8137582397603e5b5a6680339be..1dc69605999b2690506ef4a4575fbc4126018dd3 100644
--- a/include/caosdb/transaction.h
+++ b/include/caosdb/transaction.h
@@ -32,6 +32,8 @@
 #include "caosdb/entity.h"                       // for Entity
 #include "caosdb/entity/v1alpha1/main.grpc.pb.h" // for EntityTransactionSe...
 #include "caosdb/entity/v1alpha1/main.pb.h"      // for Entity, RetrieveReq...
+#include <memory>                                // for shared_ptr, unique_ptr
+#include <string>                                // for string
 
 namespace caosdb::transaction {
 using caosdb::entity::Entity;
diff --git a/include/caosdb/utility.h b/include/caosdb/utility.h
index 5d3ac6147222f01b0edc4f659a6bc242b8bd21b0..e1e306e40a82ced49ccefea45a42a9e63a2b04b9 100644
--- a/include/caosdb/utility.h
+++ b/include/caosdb/utility.h
@@ -21,16 +21,18 @@
 
 #ifndef CAOSDB_UTILS_H
 #define CAOSDB_UTILS_H
-#include <cassert>
-#include <iostream>
-#include <string_view>
-#include <fstream>
-#include <string>
-#include <cstdlib>
-#include <boost/json.hpp>
 #include <boost/beast/core/detail/base64.hpp>
 #include <boost/filesystem.hpp>
 #include <boost/filesystem/fstream.hpp>
+#include <boost/filesystem/string_file.hpp>
+#include <boost/json.hpp>
+#include <cassert>
+#include <cstdlib>
+#include <fstream>
+#include <iostream>
+#include <memory>
+#include <string>
+#include <string_view>
 
 namespace caosdb::utility {
 using boost::filesystem::exists;
@@ -44,18 +46,9 @@ using boost::json::value;
  *
  * TODO use boost-filesystem's "load_string_file"!
  */
-inline auto load_string_file(const std::string &path) -> std::string {
-  const auto path_view = std::string_view{path};
-  constexpr auto size = std::size_t{4096};
-  auto stream = std::ifstream{path_view.data()};
-  stream.exceptions(std::ios_base::badbit);
-
-  auto result = std::string();
-  auto buffer = std::string(size, '\0');
-  while (stream.read(&buffer[0], size)) {
-    result.append(buffer, 0, stream.gcount());
-  }
-  result.append(buffer, 0, stream.gcount());
+inline auto load_string_file(const path &path) -> std::string {
+  std::string result;
+  boost::filesystem::load_string_file(path, result);
   return result;
 }
 
@@ -88,11 +81,12 @@ inline auto base64_encode(const std::string &plain) -> std::string {
   auto size_plain = plain.size();
   auto size_encoded = boost::beast::detail::base64::encoded_size(size_plain);
 
-  char encoded[size_encoded];
-  boost::beast::detail::base64::encode(&encoded, plain.c_str(), size_plain);
+  std::unique_ptr<char[]> encoded(new char[size_encoded]);
+  boost::beast::detail::base64::encode(encoded.get(), plain.c_str(),
+                                       size_plain);
 
   // the encoded char[] is not null terminated, so explicitely set the length
-  return std::string(encoded, encoded + size_encoded);
+  return std::string(encoded.get(), encoded.get() + size_encoded);
 }
 
 inline auto load_json_file(const path &json_file) -> value {
diff --git a/include/ccaosdb.h b/include/ccaosdb.h
index f9ed3bcc5725bbfd5cf8f6eec281f1a686e930f6..47bf568bca96c68c8457766d2279475b434de386 100644
--- a/include/ccaosdb.h
+++ b/include/ccaosdb.h
@@ -7,27 +7,27 @@ extern "C" {
 /**
  * Return the constant caosdb::LIBCAOSDB_VERSION_MAJOR.
  */
-const int caosdb_constants_LIBCAOSDB_VERSION_MAJOR();
+int caosdb_constants_LIBCAOSDB_VERSION_MAJOR();
 /**
  * Return the constant caosdb::LIBCAOSDB_VERSION_MINOR
  */
-const int caosdb_constants_LIBCAOSDB_VERSION_MINOR();
+int caosdb_constants_LIBCAOSDB_VERSION_MINOR();
 /**
  * Return the constant caosdb::LIBCAOSDB_VERSION_PATCH.
  */
-const int caosdb_constants_LIBCAOSDB_VERSION_PATCH();
+int caosdb_constants_LIBCAOSDB_VERSION_PATCH();
 /**
  * Return the constant caosdb::COMPATIBLE_SERVER_VERSION_MAJOR.
  */
-const int caosdb_constants_COMPATIBLE_SERVER_VERSION_MAJOR();
+int caosdb_constants_COMPATIBLE_SERVER_VERSION_MAJOR();
 /**
  * Return the constant caosdb::COMPATIBLE_SERVER_VERSION_MINOR.
  */
-const int caosdb_constants_COMPATIBLE_SERVER_VERSION_MINOR();
+int caosdb_constants_COMPATIBLE_SERVER_VERSION_MINOR();
 /**
  * Return the constant caosdb::COMPATIBLE_SERVER_VERSION_PATCH.
  */
-const int caosdb_constants_COMPATIBLE_SERVER_VERSION_PATCH();
+int caosdb_constants_COMPATIBLE_SERVER_VERSION_PATCH();
 /**
  * Return the constant caosdb::COMPATIBLE_SERVER_VERSION_PRE_RELEASE.
  */
diff --git a/src/caosdb/authentication.cpp b/src/caosdb/authentication.cpp
index 7bc70de4efbd5a09bf96fbfb240110d5a8bb45b3..a1c84e5b5b04ebc5e0e6909ad4d274f5389117bb 100644
--- a/src/caosdb/authentication.cpp
+++ b/src/caosdb/authentication.cpp
@@ -19,13 +19,13 @@
  *
  */
 #include "caosdb/authentication.h"
+#include "grpcpp/security/credentials.h"    // for MetadataCredentialsPlugin
 #include <grpcpp/impl/codegen/status.h>     // for Status, Status::OK
 #include <grpcpp/impl/codegen/string_ref.h> // for string_ref
 #include <map>                              // for multimap
 #include <memory>                           // for allocator, shared_ptr
 #include <string>                           // for basic_string, operator+
 #include <utility>                          // for pair, move, make_pair
-#include "grpcpp/security/credentials.h"    // for MetadataCredentialsFromP...
 
 namespace caosdb::authentication {
 using caosdb::utility::base64_encode;
@@ -36,7 +36,7 @@ using grpc::string_ref;
 
 MetadataCredentialsPluginImpl::MetadataCredentialsPluginImpl(std::string key,
                                                              std::string value)
-  : key(std::move(key)), value(std::move(value)){};
+  : key(std::move(key)), value(std::move(value)) {}
 
 auto MetadataCredentialsPluginImpl::GetMetadata(
   string_ref /*service_url*/, string_ref /*method_name*/,
@@ -45,12 +45,12 @@ auto MetadataCredentialsPluginImpl::GetMetadata(
 
   metadata->insert(std::make_pair(this->key, this->value));
   return Status::OK;
-};
+}
 
 PlainPasswordAuthenticator::PlainPasswordAuthenticator(
   const std::string &username, const std::string &password) {
   this->basic = "Basic " + base64_encode(username + ":" + password);
-};
+}
 
 auto PlainPasswordAuthenticator::GetCallCredentials() const
   -> std::shared_ptr<grpc::CallCredentials> {
@@ -58,6 +58,6 @@ auto PlainPasswordAuthenticator::GetCallCredentials() const
     std::unique_ptr<grpc::MetadataCredentialsPlugin>(
       new MetadataCredentialsPluginImpl("authentication", this->basic)));
   return call_creds;
-};
+}
 
 } // namespace caosdb::authentication
diff --git a/src/caosdb/configuration.cpp b/src/caosdb/configuration.cpp
index fd62e24865feab9b09f79248c4aaa70e2ec7ee13..2fed3e47ca474c48fa06a8180560ae9cb65de3cb 100644
--- a/src/caosdb/configuration.cpp
+++ b/src/caosdb/configuration.cpp
@@ -19,9 +19,6 @@
  *
  */
 #include "caosdb/configuration.h"
-#include <cstdlib>                            // for getenv
-#include <cassert>                            // for assert
-#include <string>                             // for char_traits, string
 #include "boost/iterator/iterator_facade.hpp" // for iterator_facade_base
 #include "boost/json/impl/object.hpp"         // for object::at, object::begin
 #include "boost/json/string.hpp"              // for string
@@ -30,6 +27,11 @@
 #include "caosdb/connection.h"                // for TlsConnectionConfiguration
 #include "caosdb/constants.h"                 // for LIBCAOSDB_CONFIGURATIO...
 #include "caosdb/exceptions.h"                // for ConfigurationError
+#include "caosdb/utility.h"                   // for load_string_file
+#include <cassert>                            // for assert
+#include <cstdlib>                            // for getenv
+#include <grpcpp/security/credentials.h>      // for SslCredentials
+#include <string>                             // for char_traits, string
 
 namespace caosdb::configuration {
 using boost::filesystem::exists;
@@ -38,14 +40,113 @@ using boost::json::object;
 using boost::json::value;
 using caosdb::authentication::Authenticator;
 using caosdb::authentication::PlainPasswordAuthenticator;
-using caosdb::connection::CertificateProvider;
-using caosdb::connection::ConnectionConfiguration;
-using caosdb::connection::InsecureConnectionConfiguration;
-using caosdb::connection::PemFileCertificateProvider;
-using caosdb::connection::TlsConnectionConfiguration;
+using caosdb::connection::ConnectionManager;
 using caosdb::exceptions::ConfigurationError;
 using caosdb::utility::get_home_directory;
 using caosdb::utility::load_json_file;
+using caosdb::utility::load_string_file;
+using grpc::InsecureChannelCredentials;
+using grpc::SslCredentials;
+using grpc::SslCredentialsOptions;
+
+PemFileCertificateProvider::PemFileCertificateProvider(const path &path) {
+  this->certificate_provider = load_string_file(path);
+}
+
+auto PemFileCertificateProvider::GetCertificatePem() const -> std::string {
+  return this->certificate_provider;
+}
+
+PemCertificateProvider::PemCertificateProvider(
+  const std::string &certificate_provider) {
+  this->certificate_provider = certificate_provider;
+}
+
+auto PemCertificateProvider::GetCertificatePem() const -> std::string {
+  return this->certificate_provider;
+}
+
+ConnectionConfiguration::ConnectionConfiguration(const std::string &host,
+                                                 int port) {
+  this->host = host;
+  this->port = port;
+}
+
+auto ConnectionConfiguration::GetHost() const -> std::string {
+  return this->host;
+}
+
+auto ConnectionConfiguration::GetPort() const -> int { return this->port; }
+
+auto operator<<(std::ostream &out, const ConnectionConfiguration &configuration)
+  -> std::ostream & {
+  out << configuration.ToString();
+  return out;
+}
+
+InsecureConnectionConfiguration::InsecureConnectionConfiguration(
+  const std::string &host, int port)
+  : ConnectionConfiguration(host, port) {
+  this->credentials = InsecureChannelCredentials();
+}
+
+auto InsecureConnectionConfiguration::GetChannelCredentials() const
+  -> std::shared_ptr<ChannelCredentials> {
+  return this->credentials;
+}
+
+auto InsecureConnectionConfiguration::ToString() const -> std::string {
+  return "InsecureConnectionConfiguration(" + this->GetHost() + "," +
+         std::to_string(this->GetPort()) + ")";
+}
+
+TlsConnectionConfiguration::TlsConnectionConfiguration(const std::string &host,
+                                                       int port)
+  : ConnectionConfiguration(host, port) {
+  SslCredentialsOptions options;
+  this->credentials = SslCredentials(options);
+}
+
+TlsConnectionConfiguration::TlsConnectionConfiguration(
+  const std::string &host, int port,
+  const CertificateProvider &certificate_provider)
+  : ConnectionConfiguration(host, port) {
+  SslCredentialsOptions options;
+  options.pem_root_certs = certificate_provider.GetCertificatePem();
+  this->credentials = SslCredentials(options);
+}
+
+TlsConnectionConfiguration::TlsConnectionConfiguration(
+  const std::string &host, int port, const Authenticator &authenticator)
+  : ConnectionConfiguration(host, port) {
+
+  SslCredentialsOptions options;
+  this->credentials = grpc::CompositeChannelCredentials(
+    SslCredentials(options), authenticator.GetCallCredentials());
+}
+
+TlsConnectionConfiguration::TlsConnectionConfiguration(
+  const std::string &host, int port,
+  const CertificateProvider &certificate_provider,
+  const Authenticator &authenticator)
+  : ConnectionConfiguration(host, port) {
+
+  SslCredentialsOptions options;
+  options.pem_root_certs = certificate_provider.GetCertificatePem();
+  this->credentials = grpc::CompositeChannelCredentials(
+    SslCredentials(options), authenticator.GetCallCredentials());
+}
+
+auto TlsConnectionConfiguration::GetChannelCredentials() const
+  -> std::shared_ptr<ChannelCredentials> {
+  return this->credentials;
+}
+
+auto TlsConnectionConfiguration::ToString() const -> std::string {
+  return "TlsConnectionConfiguration(" + this->GetHost() + "," +
+         std::to_string(this->GetPort()) + "," + this->certificate_provider +
+         ")";
+}
 
 auto ConnectionConfigurationHelper::CreateCertificateProvider(
   const object &from) const -> std::unique_ptr<CertificateProvider> {
@@ -53,11 +154,17 @@ auto ConnectionConfigurationHelper::CreateCertificateProvider(
   if (from.contains("server_certificate_path")) {
     const value &path_str = from.at("server_certificate_path");
     assert(path_str.is_string() == true);
+    const path certificate_file = path(path_str.as_string().c_str());
+    if (!exists(certificate_file)) {
+      throw ConfigurationError(
+        "File does not exist (server_certificate_path): " +
+        certificate_file.string());
+    }
     certificate_provider = std::make_unique<PemFileCertificateProvider>(
-      std::string(path_str.as_string().c_str()));
+      path(path_str.as_string().c_str()));
   }
   return certificate_provider;
-};
+}
 
 auto ConnectionConfigurationHelper::CreateAuthenticator(
   const object &from) const -> std::unique_ptr<Authenticator> {
@@ -87,7 +194,7 @@ auto ConnectionConfigurationHelper::CreateAuthenticator(
     }
   }
   return authenticator;
-};
+}
 
 auto ConnectionConfigurationHelper::CreateConnectionConfiguration(
   const bool tls, const std::string &host, const int port,
@@ -113,7 +220,7 @@ auto ConnectionConfigurationHelper::CreateConnectionConfiguration(
   } else {
     return std::make_unique<InsecureConnectionConfiguration>(host, port);
   }
-};
+}
 
 auto ConnectionConfigurationHelper::IsTls(const object &from) const -> bool {
   bool tls = true;
@@ -123,7 +230,7 @@ auto ConnectionConfigurationHelper::IsTls(const object &from) const -> bool {
     tls = tls_switch.as_bool();
   }
   return tls;
-};
+}
 
 auto ConnectionConfigurationHelper::CreateConnectionConfiguration(
   const object &from) const -> std::unique_ptr<ConnectionConfiguration> {
@@ -145,12 +252,12 @@ auto ConnectionConfigurationHelper::CreateConnectionConfiguration(
     tls, std::string(host.as_string().c_str()),
     static_cast<int>(port.as_int64()), certificate_provider.get(),
     authenticator.get());
-};
+}
 
 auto ConfigurationManager::mReset() -> void {
   mClear();
   InitializeDefaults();
-};
+}
 
 auto ConfigurationManager::mClear() -> void {
   json_configuration = value(nullptr);
@@ -168,14 +275,14 @@ auto ConfigurationManager::mLoadSingleJSONConfiguration(const path &json_file)
 
   json_configuration = load_json_file(json_file);
   // TODO(far future) validate against json-schema
-};
+}
 
 auto ConfigurationManager::mGetConnectionConfiguration(
   const std::string &name) const -> std::unique_ptr<ConnectionConfiguration> {
   auto connection_json = GetConnection(name);
   return connection_configuration_helper.CreateConnectionConfiguration(
     connection_json);
-};
+}
 
 auto ConfigurationManager::mGetDefaultConnectionName() const -> std::string {
   auto connections = GetConnections();
@@ -196,7 +303,7 @@ auto ConfigurationManager::mGetDefaultConnectionName() const -> std::string {
     return connections.begin()->key().to_string();
   }
   throw ConfigurationError("Could not determine the default connection.");
-};
+}
 
 auto ConfigurationManager::GetConfiguration() const -> const object & {
   if (json_configuration.is_null()) {
@@ -204,7 +311,7 @@ auto ConfigurationManager::GetConfiguration() const -> const object & {
   }
   assert(json_configuration.is_object());
   return json_configuration.as_object();
-};
+}
 
 auto ConfigurationManager::GetConnections() const -> const object & {
   const auto &configuration = GetConfiguration();
@@ -224,7 +331,7 @@ auto ConfigurationManager::GetConnections() const -> const object & {
       "This CaosDB client hasn't any configured connections.");
   }
   return connections_object;
-};
+}
 
 auto ConfigurationManager::GetConnection(const std::string &name) const
   -> const object & {
@@ -236,7 +343,7 @@ auto ConfigurationManager::GetConnection(const std::string &name) const
   }
   throw ConfigurationError("The connection '" + name +
                            "' has not been defined.");
-};
+}
 
 auto ConfigurationManager::InitializeDefaults() -> void {
 
diff --git a/src/caosdb/connection.cpp b/src/caosdb/connection.cpp
index 483b3656fffc7f0a260df692f7610d1a8944ff31..43217a4527f78f0425b5c636a1452a4b3b1b734c 100644
--- a/src/caosdb/connection.cpp
+++ b/src/caosdb/connection.cpp
@@ -20,27 +20,24 @@
  *
  */
 #include "caosdb/connection.h"
-#include <grpcpp/create_channel.h>              // for CreateChannel
-#include <grpcpp/impl/codegen/client_context.h> // for ClientContext
-#include <grpcpp/impl/codegen/status.h>         // for Status
-#include <grpcpp/security/credentials.h>        // for SslCredentials
-#include <iostream>                             // for operator<<, basic_...
-#include <stdexcept>                            // for runtime_error
-#include <string>                               // for operator+, char_tr...
-#include <memory>
-#include "caosdb/authentication.h" // for Authenticator
-#include "caosdb/configuration.h"
+#include "caosdb/configuration.h"                 // for ConnectionConfigur...
 #include "caosdb/exceptions.h"                    // for AuthenticationError
+#include "caosdb/info.h"                          // for VersionInfo
 #include "caosdb/info/v1alpha1/main.grpc.pb.h"    // for GeneralInfoService
 #include "caosdb/info/v1alpha1/main.pb.h"         // for GetVersionInfoResp...
 #include "caosdb/transaction.h"                   // for Transaction
-#include "caosdb/utility.h"                       // for load_string_file
-#include "caosdb/info.h"                          // for VersionInfo
 #include "grpcpp/impl/codegen/status_code_enum.h" // for StatusCode, UNAUTH...
+#include <grpcpp/create_channel.h>                // for CreateChannel
+#include <grpcpp/impl/codegen/client_context.h>   // for ClientContext
+#include <grpcpp/impl/codegen/status.h>           // for Status
+#include <iostream>                               // for operator<<
+#include <memory>                                 // for allocator, shared_ptr
+#include <stdexcept>                              // for runtime_error
+#include <string>                                 // for string, operator+
 
 namespace caosdb::connection {
-using caosdb::authentication::Authenticator;
 using caosdb::configuration::ConfigurationManager;
+using caosdb::configuration::ConnectionConfiguration;
 using caosdb::entity::v1alpha1::EntityTransactionService;
 using caosdb::exceptions::AuthenticationError;
 using caosdb::exceptions::ConnectionError;
@@ -49,93 +46,6 @@ using caosdb::info::v1alpha1::GeneralInfoService;
 using caosdb::info::v1alpha1::GetVersionInfoRequest;
 using caosdb::info::v1alpha1::GetVersionInfoResponse;
 using caosdb::transaction::Transaction;
-using caosdb::utility::load_string_file;
-using grpc::InsecureChannelCredentials;
-using grpc::SslCredentials;
-using grpc::SslCredentialsOptions;
-
-PemFileCertificateProvider::PemFileCertificateProvider(
-  const std::string &path) {
-  this->certificate_provider = load_string_file(path);
-}
-
-auto PemFileCertificateProvider::GetCertificatePem() const -> std::string {
-  return this->certificate_provider;
-}
-
-PemCertificateProvider::PemCertificateProvider(
-  const std::string &certificate_provider) {
-  this->certificate_provider = certificate_provider;
-}
-
-auto PemCertificateProvider::GetCertificatePem() const -> std::string {
-  return this->certificate_provider;
-}
-
-ConnectionConfiguration::ConnectionConfiguration(const std::string &host,
-                                                 int port) {
-  this->host = host;
-  this->port = port;
-}
-
-auto ConnectionConfiguration::GetHost() const -> std::string {
-  return this->host;
-}
-
-auto ConnectionConfiguration::GetPort() const -> int { return this->port; }
-
-InsecureConnectionConfiguration::InsecureConnectionConfiguration(
-  const std::string &host, int port)
-  : ConnectionConfiguration(host, port) {
-  this->credentials = InsecureChannelCredentials();
-}
-
-auto InsecureConnectionConfiguration::GetChannelCredentials() const
-  -> std::shared_ptr<ChannelCredentials> {
-  return this->credentials;
-}
-
-TlsConnectionConfiguration::TlsConnectionConfiguration(const std::string &host,
-                                                       int port)
-  : ConnectionConfiguration(host, port) {
-  SslCredentialsOptions options;
-  this->credentials = SslCredentials(options);
-}
-
-TlsConnectionConfiguration::TlsConnectionConfiguration(
-  const std::string &host, int port,
-  const CertificateProvider &certificate_provider)
-  : ConnectionConfiguration(host, port) {
-  SslCredentialsOptions options;
-  options.pem_root_certs = certificate_provider.GetCertificatePem();
-  this->credentials = SslCredentials(options);
-}
-
-TlsConnectionConfiguration::TlsConnectionConfiguration(
-  const std::string &host, int port, const Authenticator &authenticator)
-  : ConnectionConfiguration(host, port) {
-
-  SslCredentialsOptions options;
-  this->credentials = grpc::CompositeChannelCredentials(
-    SslCredentials(options), authenticator.GetCallCredentials());
-}
-
-TlsConnectionConfiguration::TlsConnectionConfiguration(
-  const std::string &host, int port,
-  const CertificateProvider &certificate_provider,
-  const Authenticator &authenticator)
-  : ConnectionConfiguration(host, port) {
-
-  SslCredentialsOptions options;
-  options.pem_root_certs = certificate_provider.GetCertificatePem();
-  this->credentials = grpc::CompositeChannelCredentials(
-    SslCredentials(options), authenticator.GetCallCredentials());
-}
-
-auto TlsConnectionConfiguration::GetChannelCredentials() const
-  -> std::shared_ptr<ChannelCredentials> {
-  return this->credentials;
-}
 
 Connection::Connection(const ConnectionConfiguration &configuration) {
   const std::string target =
@@ -185,7 +95,7 @@ auto Connection::RetrieveVersionInfo() const -> const VersionInfo & {
   -> std::unique_ptr<Transaction> {
   auto service_stub = this->entity_transaction_service;
   return std::make_unique<Transaction>(service_stub);
-};
+}
 
 auto ConnectionManager::mHasConnection(const std::string &name) const -> bool {
   auto it = connections.find(name);
diff --git a/src/caosdb/transaction.cpp b/src/caosdb/transaction.cpp
index 317d20518341e662442d0d84be63d2f9f184c031..31b552a58bde9110d4064f2c5dc6186c64432057 100644
--- a/src/caosdb/transaction.cpp
+++ b/src/caosdb/transaction.cpp
@@ -17,19 +17,17 @@
  * along with this program. If not, see <https://www.gnu.org/licenses/>.
  *
  */
-
-#include "caosdb/entity.h"
-#include "caosdb/exceptions.h" // for AuthenticationError
 #include "caosdb/transaction.h"
-#include <memory>
-#include <utility>
-#include <iostream>                               // for basic_ostream::ope...
-#include <stdexcept>                              // for runtime_error
+#include "caosdb/entity/v1alpha1/main.grpc.pb.h"  // for EntityTransactionS...
+#include "caosdb/entity/v1alpha1/main.pb.h"       // for RetrieveRequest
+#include "caosdb/exceptions.h"                    // for AuthenticationError
+#include "grpcpp/impl/codegen/status_code_enum.h" // for StatusCode, UNAUTH...
 #include <grpcpp/impl/codegen/client_context.h>   // for ClientContext
 #include <grpcpp/impl/codegen/status.h>           // for Status
-#include "grpcpp/impl/codegen/status_code_enum.h" // for StatusCode, UNAUTH...
-#include "caosdb/entity/v1alpha1/main.pb.h"
-#include "caosdb/entity/v1alpha1/main.grpc.pb.h"
+#include <iostream>                               // for basic_ostream::ope...
+#include <memory>                                 // for make_unique, share...
+#include <stdexcept>                              // for runtime_error
+#include <utility>                                // for move
 
 namespace caosdb::transaction {
 using caosdb::entity::v1alpha1::EntityTransactionService;
diff --git a/src/ccaosdb.cpp b/src/ccaosdb.cpp
index 2c9539af8036de10d36bb41b6ce188070cb21bcc..42ca0488bfaa6fe99f94c1acf2b4f7fa5d32fb07 100644
--- a/src/ccaosdb.cpp
+++ b/src/ccaosdb.cpp
@@ -1,35 +1,34 @@
-#include <iostream>
-#include <stdio.h>
-#include <cassert>
+#include "ccaosdb.h"
+#include "caosdb/connection.h"
 #include "caosdb/constants.h"
 #include "caosdb/utility.h"
-#include "caosdb/constants.h"
-#include "caosdb/connection.h"
-#include "ccaosdb.h"
+#include <cassert>
+#include <iostream>
+#include <stdio.h>
 
 extern "C" {
 
-const int caosdb_constants_LIBCAOSDB_VERSION_MAJOR() {
+int caosdb_constants_LIBCAOSDB_VERSION_MAJOR() {
   return caosdb::LIBCAOSDB_VERSION_MAJOR;
 }
 
-const int caosdb_constants_LIBCAOSDB_VERSION_MINOR() {
+int caosdb_constants_LIBCAOSDB_VERSION_MINOR() {
   return caosdb::LIBCAOSDB_VERSION_MINOR;
 }
 
-const int caosdb_constants_LIBCAOSDB_VERSION_PATCH() {
+int caosdb_constants_LIBCAOSDB_VERSION_PATCH() {
   return caosdb::LIBCAOSDB_VERSION_PATCH;
 }
 
-const int caosdb_constants_COMPATIBLE_SERVER_VERSION_MAJOR() {
+int caosdb_constants_COMPATIBLE_SERVER_VERSION_MAJOR() {
   return caosdb::COMPATIBLE_SERVER_VERSION_MAJOR;
 }
 
-const int caosdb_constants_COMPATIBLE_SERVER_VERSION_MINOR() {
+int caosdb_constants_COMPATIBLE_SERVER_VERSION_MINOR() {
   return caosdb::COMPATIBLE_SERVER_VERSION_MINOR;
 }
 
-const int caosdb_constants_COMPATIBLE_SERVER_VERSION_PATCH() {
+int caosdb_constants_COMPATIBLE_SERVER_VERSION_PATCH() {
   return caosdb::COMPATIBLE_SERVER_VERSION_PATCH;
 }
 
@@ -45,13 +44,13 @@ const char *caosdb_utility_get_env_var(const char *name,
 int caosdb_connection_create_pem_file_certificate_provider(
   caosdb_connection_certificate_provider *out, const char *path) {
   out->wrapped_certificate_provider =
-    new caosdb::connection::PemFileCertificateProvider(std::string(path));
+    new caosdb::configuration::PemFileCertificateProvider(std::string(path));
   return 0;
 }
 
 int caosdb_connection_delete_certificate_provider(
   caosdb_connection_certificate_provider *provider) {
-  delete static_cast<caosdb::connection::CertificateProvider *>(
+  delete static_cast<caosdb::configuration::CertificateProvider *>(
     provider->wrapped_certificate_provider);
   return 0;
 }
@@ -80,31 +79,31 @@ int caosdb_connection_create_tls_connection_configuration(
   auto host_str = std::string(host);
   if (authenticator != nullptr && provider != nullptr) {
     auto wrapped_provider =
-      static_cast<caosdb::connection::CertificateProvider *>(
+      static_cast<caosdb::configuration::CertificateProvider *>(
         provider->wrapped_certificate_provider);
     auto wrapped_authenticator =
       static_cast<caosdb::authentication::Authenticator *>(
         authenticator->wrapped_authenticator);
     out->wrapped_connection_configuration =
-      new caosdb::connection::TlsConnectionConfiguration(
+      new caosdb::configuration::TlsConnectionConfiguration(
         host_str, port, *wrapped_provider, *wrapped_authenticator);
   } else if (authenticator != nullptr) {
     auto wrapped_authenticator =
       static_cast<caosdb::authentication::Authenticator *>(
         authenticator->wrapped_authenticator);
     out->wrapped_connection_configuration =
-      new caosdb::connection::TlsConnectionConfiguration(
+      new caosdb::configuration::TlsConnectionConfiguration(
         host_str, port, *wrapped_authenticator);
   } else if (provider != nullptr) {
     auto wrapped_provider =
-      static_cast<caosdb::connection::CertificateProvider *>(
+      static_cast<caosdb::configuration::CertificateProvider *>(
         provider->wrapped_certificate_provider);
     out->wrapped_connection_configuration =
-      new caosdb::connection::TlsConnectionConfiguration(host_str, port,
-                                                         *wrapped_provider);
+      new caosdb::configuration::TlsConnectionConfiguration(host_str, port,
+                                                            *wrapped_provider);
   } else {
     out->wrapped_connection_configuration =
-      new caosdb::connection::TlsConnectionConfiguration(host_str, port);
+      new caosdb::configuration::TlsConnectionConfiguration(host_str, port);
   }
   return 0;
 }
@@ -113,13 +112,13 @@ int caosdb_connection_create_insecure_connection_configuration(
   caosdb_connection_connection_configuration *out, const char *host,
   const int port) {
   out->wrapped_connection_configuration =
-    new caosdb::connection::InsecureConnectionConfiguration(host, port);
+    new caosdb::configuration::InsecureConnectionConfiguration(host, port);
   return 0;
 }
 
 int caosdb_connection_delete_connection_configuration(
   caosdb_connection_connection_configuration *configuration) {
-  delete static_cast<caosdb::connection::ConnectionConfiguration *>(
+  delete static_cast<caosdb::configuration::ConnectionConfiguration *>(
     configuration->wrapped_connection_configuration);
   return 0;
 }
@@ -127,8 +126,8 @@ int caosdb_connection_delete_connection_configuration(
 int caosdb_connection_create_connection(
   caosdb_connection_connection *out,
   const caosdb_connection_connection_configuration *configuration) {
-  caosdb::connection::ConnectionConfiguration *config =
-    static_cast<caosdb::connection::ConnectionConfiguration *>(
+  caosdb::configuration::ConnectionConfiguration *config =
+    static_cast<caosdb::configuration::ConnectionConfiguration *>(
       configuration->wrapped_connection_configuration);
   out->wrapped_connection = new caosdb::connection::Connection(*config);
   return 0;
diff --git a/src/ccaosdbcli.c b/src/ccaosdbcli.c
index eaadc3c5822b1306140f530dddc7c4a49981e388..ba30b8d6493598e4b06991788ae8fe6001ec1cfb 100644
--- a/src/ccaosdbcli.c
+++ b/src/ccaosdbcli.c
@@ -1,6 +1,6 @@
-#include <stdio.h>            // for printf
 #include "caosdb/constants.h" // for LIBCAOSDB_VERSION_MAJOR, LIBCAOSDB_VER...
 #include "ccaosdb.h"          // for caosdb_info_version_info, caosdb_conne...
+#include <stdio.h>            // for printf
 
 int main(void) {
   printf(
diff --git a/src/cxxcaosdbcli.cpp b/src/cxxcaosdbcli.cpp
index 763ddb5177ae372a06767b721b909742624bc2f1..0603af132cf7f1febbbd67e344a13f3c84253594 100644
--- a/src/cxxcaosdbcli.cpp
+++ b/src/cxxcaosdbcli.cpp
@@ -21,14 +21,14 @@
  */
 
 // A simple caosdb client
-#include <iostream>             // for operator<<, basic_ostream, basic_ost...
-#include <memory>               // for unique_ptr, allocator, __shared_ptr_...
-#include <string>               // for operator<<, char_traits
 #include "caosdb/connection.h"  // for Connection, ConnectionManager
 #include "caosdb/constants.h"   // for LIBCAOSDB_VERSION_MINOR, LIBCAOSDB_V...
 #include "caosdb/entity.h"      // for Entity
 #include "caosdb/info.h"        // for VersionInfo
 #include "caosdb/transaction.h" // for Transaction, UniqueResult, ResultSet
+#include <iostream>             // for operator<<, basic_ostream, basic_ost...
+#include <memory>               // for unique_ptr, allocator, __shared_ptr_...
+#include <string>               // for operator<<, char_traits
 
 auto main() -> int {
   std::cout << "CaosDB C++ client (libcaosdb "
diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
index 17613e450d2cf7c66fd41d215d0640c2df3d0292..aab1f0a35b5a71436505a9ad33d13deabeafb8aa 100644
--- a/test/CMakeLists.txt
+++ b/test/CMakeLists.txt
@@ -91,8 +91,12 @@ if (LCOV_PATH)
         GENHTML_ARGS --rc lcov_branch_coverage=1
         )
     message(STATUS "Adding COMPILE_FLAGS for coverage: ${COVERAGE_COMPILER_FLAGS}")
-    set_target_properties(caosdb ccaosdb PROPERTIES
-        COMPILE_FLAGS "${CMAKE_CXX_FLAGS} ${COVERAGE_COMPILER_FLAGS}")
+    set(TARGET_CAOSDB_COMPILE_FLAGS "${TARGET_CAOSDB_COMPILE_FLAGS} ${COVERAGE_COMPILER_FLAGS}" PARENT_SCOPE)
+    set(TARGET_CCAOSDB_COMPILE_FLAGS "${TARGET_CCAOSDB_COMPILE_FLAGS} ${COVERAGE_COMPILER_FLAGS}" PARENT_SCOPE)
+    set_target_properties(caosdb PROPERTIES
+        COMPILE_FLAGS "${TARGET_CAOSDB_COMPILE_FLAGS}")
+    set_target_properties(caosdb PROPERTIES
+        COMPILE_FLAGS "${TARGET_CCAOSDB_COMPILE_FLAGS}")
 else ()
     message(WARNING "Could not generate code coverage report. Please install lcov.")
 endif ()
diff --git a/test/test_ccaosdb.cpp b/test/test_ccaosdb.cpp
index b32ace97cbd888d7f60134c995cefaa1483fa79c..abb06dd7426a642ef1e54593d67e28015168cc71 100644
--- a/test/test_ccaosdb.cpp
+++ b/test/test_ccaosdb.cpp
@@ -20,13 +20,13 @@
  *
  */
 
+#include "caosdb/configuration.h"
+#include "caosdb_test_utility.h"   // for EXPECT_THROW_MESSAGE, TEST_DATA_DIR
+#include "ccaosdb.h"               // for caosdb_utility_get_env_var
 #include <gtest/gtest-message.h>   // for Message
 #include <gtest/gtest-test-part.h> // for SuiteApiResolver, TestFactoryImpl
 #include <gtest/gtest_pred_impl.h> // for Test, TestInfo, EXPECT_EQ, TEST
 #include <string>                  // for allocator
-#include "caosdb_test_utility.h"   // for EXPECT_THROW_MESSAGE, TEST_DATA_DIR
-#include "ccaosdb.h"               // for caosdb_utility_get_env_var
-#include "caosdb/configuration.h"
 
 class test_ccaosdb : public ::testing::Test {
 protected:
diff --git a/test/test_configuration.cpp b/test/test_configuration.cpp
index c7db0390fa220a60daa746f88900c0c6c3f33b87..fa5ecb2fc77e69132226044f4a7a129129f4e320 100644
--- a/test/test_configuration.cpp
+++ b/test/test_configuration.cpp
@@ -19,13 +19,13 @@
  * along with this program. If not, see <https://www.gnu.org/licenses/>.
  *
  */
+#include "caosdb/configuration.h"  // for ConfigurationManager, Configurati...
+#include "caosdb/exceptions.h"     // for ConfigurationError
+#include "caosdb_test_utility.h"   // for EXPECT_THROW_MESSAGE, TEST_DATA_DIR
 #include <gtest/gtest-message.h>   // for Message
 #include <gtest/gtest-test-part.h> // for TestPartResult, SuiteApiResolver
 #include <gtest/gtest_pred_impl.h> // for Test, TestInfo, TEST
 #include <string>                  // for operator+, allocator, string
-#include "caosdb/configuration.h"  // for ConfigurationManager, Configurati...
-#include "caosdb/exceptions.h"     // for ConfigurationError
-#include "caosdb_test_utility.h"   // for EXPECT_THROW_MESSAGE, TEST_DATA_DIR
 
 namespace caosdb::configuration {
 
diff --git a/test/test_connection.cpp b/test/test_connection.cpp
index 556b49e3cb01cce82a91f10a4b20b6ae7e84ee82..7c2efab9566d58c709c060e4206fc0d193ac75df 100644
--- a/test/test_connection.cpp
+++ b/test/test_connection.cpp
@@ -19,19 +19,22 @@
  * along with this program. If not, see <https://www.gnu.org/licenses/>.
  *
  */
-
-#include <gtest/gtest-message.h>   // for Message
-#include <gtest/gtest-test-part.h> // for TestPartResult, SuiteApiResolver
-#include <memory>                  // for allocator, operator!=, shared_ptr
-#include <string>                  // for operator+, string
-#include "caosdb/configuration.h"  // for ConfigurationManager
-#include "caosdb/connection.h"     // for ConnectionManager, InsecureConnec...
-#include "caosdb/exceptions.h"     // for UnknownConnectionError
-#include "caosdb_test_utility.h"   // for EXPECT_THROW_MESSAGE, TEST_DATA_DIR
-#include "gtest/gtest_pred_impl.h" // for Test, AssertionResult, TestInfo
+#include "caosdb/certificate_provider.h" // for PemCertificateProvider
+#include "caosdb/configuration.h"        // for InsecureConnectionConfigura...
+#include "caosdb/connection.h"           // for ConnectionManager
+#include "caosdb/exceptions.h"           // for UnknownConnectionError
+#include "caosdb_test_utility.h"         // for EXPECT_THROW_MESSAGE, TEST_...
+#include <gtest/gtest-message.h>         // for Message
+#include <gtest/gtest-test-part.h>       // for SuiteApiResolver, TestPartR...
+#include "gtest/gtest_pred_impl.h"       // for AssertionResult, TestInfo
+#include <memory>                        // for allocator, operator!=, shar...
+#include <string>                        // for operator+, string
 
 namespace caosdb::connection {
 using caosdb::configuration::ConfigurationManager;
+using caosdb::configuration::InsecureConnectionConfiguration;
+using caosdb::configuration::PemCertificateProvider;
+using caosdb::configuration::TlsConnectionConfiguration;
 
 class test_connection : public ::testing::Test {
 protected:
diff --git a/test/test_data/test_broken_caosdb_client_certificate_file_non_existent.json b/test/test_data/test_broken_caosdb_client_certificate_file_non_existent.json
new file mode 100644
index 0000000000000000000000000000000000000000..832b0a62b674af5500815ca1726ccddf9802d757
--- /dev/null
+++ b/test/test_data/test_broken_caosdb_client_certificate_file_non_existent.json
@@ -0,0 +1,28 @@
+{
+  "connections": {
+    "default": "local-caosdb",
+    "local-caosdb-admin": {
+      "host": "localhost",
+      "port": 8443,
+      "server_certificate_path": "some/path/cacert.pem",
+      "authentication": {
+        "type": "plain",
+        "username": "admin",
+        "password": "caosdb"
+      }
+    },
+    "local-caosdb": {
+      "host": "localhost",
+      "port": 8443,
+      "server_certificate_path": "some/path/cacert.pem",
+      "authentication": {
+        "type": "plain",
+        "username": "me",
+        "password": "secret!"
+      }
+    }
+  },
+  "extension": {
+    "this is my": "special option"
+  }
+}
diff --git a/test/test_data/test_caosdb_client.json b/test/test_data/test_caosdb_client.json
index 832b0a62b674af5500815ca1726ccddf9802d757..10102bc84b612afd2f836374421310670a2c1c53 100644
--- a/test/test_data/test_caosdb_client.json
+++ b/test/test_data/test_caosdb_client.json
@@ -4,7 +4,6 @@
     "local-caosdb-admin": {
       "host": "localhost",
       "port": 8443,
-      "server_certificate_path": "some/path/cacert.pem",
       "authentication": {
         "type": "plain",
         "username": "admin",
@@ -14,7 +13,6 @@
     "local-caosdb": {
       "host": "localhost",
       "port": 8443,
-      "server_certificate_path": "some/path/cacert.pem",
       "authentication": {
         "type": "plain",
         "username": "me",
diff --git a/test/test_info.cpp b/test/test_info.cpp
index 2a806a63ac9fcc8a3c3a9bb8b8cdf582e63cf3d1..a95870200ac51343f86b7bb5ff4c0c433d692f0c 100644
--- a/test/test_info.cpp
+++ b/test/test_info.cpp
@@ -20,12 +20,12 @@
  *
  */
 
-#include <gtest/gtest-message.h>          // for Message
-#include <gtest/gtest-test-part.h>        // for TestPartResult, SuiteApiRe...
-#include <memory>                         // for allocator
 #include "caosdb/info.h"                  // for VersionInfo
 #include "caosdb/info/v1alpha1/main.pb.h" // for VersionInfo
+#include <gtest/gtest-message.h>          // for Message
+#include <gtest/gtest-test-part.h>        // for TestPartResult, SuiteApiRe...
 #include "gtest/gtest_pred_impl.h"        // for Test, EXPECT_EQ, TEST
+#include <memory>                         // for allocator
 
 namespace caosdb::info {
 using ProtoVersionInfo = caosdb::info::v1alpha1::VersionInfo;
diff --git a/test/test_transaction.cpp b/test/test_transaction.cpp
index b528ae2ca01c53f2053002f7958a9a0cc466c50d..e970b6df14ae4d407ad3eb2825a1d1a01fcb6692 100644
--- a/test/test_transaction.cpp
+++ b/test/test_transaction.cpp
@@ -19,9 +19,8 @@
  * along with this program. If not, see <https://www.gnu.org/licenses/>.
  *
  */
-
-#include <memory>                           // for allocator, make_shared
-#include "caosdb/connection.h"              // for InsecureConnection...
+#include "caosdb/configuration.h"           // for InsecureConnectionConfig...
+#include "caosdb/connection.h"              // for Connection
 #include "caosdb/entity.h"                  // for Entity
 #include "caosdb/entity/v1alpha1/main.pb.h" // for Entity
 #include "caosdb/exceptions.h"              // for ConnectionError
@@ -30,10 +29,11 @@
 #include "gtest/gtest-message.h"            // for Message
 #include "gtest/gtest-test-part.h"          // for SuiteApiResolver, TestPa...
 #include "gtest/gtest_pred_impl.h"          // for Test, TestInfo, TEST
+#include <memory>                           // for allocator, unique_ptr
 
 namespace caosdb::transaction {
+using caosdb::configuration::InsecureConnectionConfiguration;
 using caosdb::connection::Connection;
-using caosdb::connection::InsecureConnectionConfiguration;
 using caosdb::exceptions::ConnectionError;
 using caosdb::transaction::UniqueResult;
 using ProtoEntity = caosdb::entity::v1alpha1::Entity;
diff --git a/test/test_utility.cpp b/test/test_utility.cpp
index 400e0a6e05a079b0d1eb63ef894789ea249a2fea..eec62641af4b2c704ad121cf83d3450cafc5aa2a 100644
--- a/test/test_utility.cpp
+++ b/test/test_utility.cpp
@@ -20,16 +20,16 @@
  *
  */
 
-#include <gtest/gtest-message.h>              // for Message
-#include <gtest/gtest-test-part.h>            // for TestPartResult, SuiteA...
-#include <gtest/gtest_pred_impl.h>            // for Test, EXPECT_EQ, TestInfo
-#include <boost/beast/core/detail/base64.hpp> // for encoded_size
-#include <string>                             // for allocator, string, ope...
 #include "boost/json/object.hpp"              // for object
 #include "boost/json/value.hpp"               // for value
 #include "caosdb/utility.h"                   // for base64_encode, load_js...
 #include "caosdb_test_utility.h"              // for TEST_DATA_DIR
 #include "gmock/gmock-matchers.h"             // for ElementsAre, EXPECT_THAT
+#include <boost/beast/core/detail/base64.hpp> // for encoded_size
+#include <gtest/gtest-message.h>              // for Message
+#include <gtest/gtest-test-part.h>            // for TestPartResult, SuiteA...
+#include <gtest/gtest_pred_impl.h>            // for Test, EXPECT_EQ, TestInfo
+#include <string>                             // for allocator, string, ope...
 
 namespace caosdb::utility {
 using ::testing::ElementsAre;