diff --git a/Cargo.lock b/Cargo.lock
index 2971df2..692159b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3079,7 +3079,7 @@ dependencies = [
 
 [[package]]
 name = "rproxy"
-version = "0.0.6"
+version = "0.0.7"
 dependencies = [
  "actix",
  "actix-http",
diff --git a/crates/rproxy/Cargo.toml b/crates/rproxy/Cargo.toml
index 41d7572..214a538 100644
--- a/crates/rproxy/Cargo.toml
+++ b/crates/rproxy/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "rproxy"
-version = "0.0.6"
+version = "0.0.7"
 edition = "2024"
 default-run = "rproxy"
 
diff --git a/crates/rproxy/src/server/metrics.rs b/crates/rproxy/src/server/metrics.rs
index 01303be..2b36637 100644
--- a/crates/rproxy/src/server/metrics.rs
+++ b/crates/rproxy/src/server/metrics.rs
@@ -222,7 +222,7 @@ impl Metrics {
 
         this.registry.register_with_unit(
             "ws_latency_client",
-            "round-trip-time of websocket pings to backend divided by 2",
+            "round-trip-time of websocket pings to client divided by 2",
             Unit::Other(String::from("nanoseconds")),
             this.ws_latency_client.clone(),
         );
diff --git a/crates/rproxy/src/server/proxy/config/tls.rs b/crates/rproxy/src/server/proxy/config/tls.rs
index 4aadf0c..b12c7e8 100644
--- a/crates/rproxy/src/server/proxy/config/tls.rs
+++ b/crates/rproxy/src/server/proxy/config/tls.rs
@@ -49,7 +49,7 @@ impl ConfigTls {
         let mut errs: Vec<ConfigTlsError> = vec![];
 
         let mut cert: Option<Vec<CertificateDer>> = None;
-        let key: Option<PrivateKeyDer> = None;
+        let mut key: Option<PrivateKeyDer> = None;
 
         // certificate
         {
@@ -93,6 +93,12 @@ impl ConfigTls {
                                 }
 
                                 Ok(res) => {
+                                    if res.is_empty() {
+                                        errs.push(ConfigTlsError::InvalidCertificate {
+                                            path: self.certificate.clone(),
+                                            err: String::from("the certificate is missing"),
+                                        });
+                                    }
                                     cert = Some(res);
                                 }
                             }
@@ -134,8 +140,7 @@ impl ConfigTls {
 
                             let mut reader = Cursor::new(raw);
 
-                            match rustls_pemfile::certs(&mut reader).collect::<Result<Vec<_>, _>>()
-                            {
+                            match rustls_pemfile::private_key(&mut reader) {
                                 Err(err) => {
                                     errs.push(ConfigTlsError::InvalidKey {
                                         path: self.certificate.clone(),
@@ -144,7 +149,13 @@ impl ConfigTls {
                                 }
 
                                 Ok(res) => {
-                                    cert = Some(res);
+                                    if res.is_none() {
+                                        errs.push(ConfigTlsError::InvalidKey {
+                                            path: self.certificate.clone(),
+                                            err: String::from("the key is missing"),
+                                        });
+                                    }
+                                    key = res;
                                 }
                             }
                         }
@@ -222,7 +233,7 @@ impl ConfigTls {
 
 #[derive(Debug, Clone, Error)]
 pub(crate) enum ConfigTlsError {
-    #[error("invalid tls certificate at '{path}': {err}")]
+    #[error("invalid tls certificate in '{path}': {err}")]
     InvalidCertificate { path: String, err: String },
 
     #[error("invalid tls certificate file '{path}': {err}")]
@@ -231,7 +242,7 @@ pub(crate) enum ConfigTlsError {
     #[error("path to tls certificate is missing")]
     MissingCertificate,
 
-    #[error("invalid tls key at '{path}': {err}")]
+    #[error("invalid tls key in '{path}': {err}")]
     InvalidKey { path: String, err: String },
 
     #[error("invalid tls key file '{path}': {err}")]
diff --git a/crates/rproxy/src/server/proxy/ws/proxy.rs b/crates/rproxy/src/server/proxy/ws/proxy.rs
index 1bc8085..06190eb 100644
--- a/crates/rproxy/src/server/proxy/ws/proxy.rs
+++ b/crates/rproxy/src/server/proxy/ws/proxy.rs
@@ -697,7 +697,7 @@ where
                                 .ws_latency_client
                                 .get_or_create(&LabelsProxyWs {
                                     proxy: P::name(),
-                                    destination: WS_LABEL_BKND,
+                                    destination: WS_LABEL_CLNT,
                                 })
                                 .record(
                                     (1000000.0 * (timestamp - pong.timestamp).as_seconds_f64() /
diff --git a/readme.md b/readme.md
index 6dfe36b..cf78ba0 100644
--- a/readme.md
+++ b/readme.md
@@ -440,7 +440,7 @@ tls:
 # TYPE rproxy_ws_latency_backend_nanoseconds gauge
 # UNIT rproxy_ws_latency_backend_nanoseconds nanoseconds
 
-# HELP rproxy_ws_latency_client_nanoseconds round-trip-time of websocket pings to backend divided by 2.
+# HELP rproxy_ws_latency_client_nanoseconds round-trip-time of websocket pings to client divided by 2.
 # TYPE rproxy_ws_latency_client_nanoseconds gauge
 # UNIT rproxy_ws_latency_client_nanoseconds nanoseconds