diff --git a/examples/demo/otel-collector-config.yaml b/examples/demo/otel-collector-config.yaml
index 87d74c69e8da..211faa82ffed 100644
--- a/examples/demo/otel-collector-config.yaml
+++ b/examples/demo/otel-collector-config.yaml
@@ -17,7 +17,8 @@ exporters:
 
   jaeger:
     endpoint: jaeger-all-in-one:14250
-    insecure: true
+    tls:
+      insecure: true
 
 processors:
   batch:
diff --git a/exporter/elasticexporter/README.md b/exporter/elasticexporter/README.md
index 59246da7e99b..442c6fb72950 100644
--- a/exporter/elasticexporter/README.md
+++ b/exporter/elasticexporter/README.md
@@ -54,7 +54,8 @@ exporters:
 exporters:
   otlp/elastic:
       endpoint: "localhost:8200"
-      insecure: true
+      tls:
+        insecure: true
 ```
 
 ## Migration
@@ -121,6 +122,7 @@ Complete documentation is available on [Elastic.co](https://www.elastic.co/guide
 - `apm_server_url` (required): Elastic APM Server URL.
 - `api_key` (optional): credential for API Key authorization, if enabled in Elastic APM Server.
 - `secret_token` (optional): credential for Secret Token authorization, if enabled in Elastic APM Server.
+#### The below options all belong beneath the `tls` header
 - `ca_file` (optional): root Certificate Authority (CA) certificate, for verifying the server's identity, if TLS is enabled.
 - `cert_file` (optional): client TLS certificate.
 - `key_file` (optional): client TLS key.
diff --git a/exporter/jaegerexporter/README.md b/exporter/jaegerexporter/README.md
index 31941ad3ec27..1540447c4c0a 100644
--- a/exporter/jaegerexporter/README.md
+++ b/exporter/jaegerexporter/README.md
@@ -13,7 +13,7 @@ The following settings are required:
 using the gRPC protocol. The valid syntax is described
 [here](https://github.com/grpc/grpc/blob/master/doc/naming.md)
 
-By default, TLS is enabled:
+By default, TLS is enabled and must be configured under `tls`:
 
 - `insecure` (default = `false`): whether to enable client transport security for
   the exporter's connection.
@@ -31,11 +31,13 @@ Example:
 exporters:
   jaeger:
     endpoint: jaeger-all-in-one:14250
-    cert_file: file.cert
-    key_file: file.key
+    tls:
+      cert_file: file.cert
+      key_file: file.key
   jaeger/2:
     endpoint: jaeger-all-in-one:14250
-    insecure: true
+    tls:
+      insecure: true
 ```
 
 ## Advanced Configuration
diff --git a/exporter/loadbalancingexporter/README.md b/exporter/loadbalancingexporter/README.md
index 62be506ca817..2a436e811b11 100644
--- a/exporter/loadbalancingexporter/README.md
+++ b/exporter/loadbalancingexporter/README.md
@@ -96,7 +96,8 @@ exporters:
     protocol:
       otlp:
         timeout: 1s
-        insecure: true
+        tls:
+          insecure: true
     resolver:
       static:
         hostnames:
diff --git a/exporter/loadbalancingexporter/example/otel-agent-config.yaml b/exporter/loadbalancingexporter/example/otel-agent-config.yaml
index 8b9496a14ffa..ff9f36a5e9e1 100644
--- a/exporter/loadbalancingexporter/example/otel-agent-config.yaml
+++ b/exporter/loadbalancingexporter/example/otel-agent-config.yaml
@@ -12,7 +12,8 @@ exporters:
     protocol:
       otlp:
         timeout: 1s
-        insecure: true
+        tls:
+          insecure: true
     resolver:
       static:
         hostnames:
diff --git a/exporter/opencensusexporter/README.md b/exporter/opencensusexporter/README.md
index a7a25b13ed08..094fbd7123eb 100644
--- a/exporter/opencensusexporter/README.md
+++ b/exporter/opencensusexporter/README.md
@@ -13,7 +13,7 @@ The following settings are required:
 using the gRPC protocol. The valid syntax is described
 [here](https://github.com/grpc/grpc/blob/master/doc/naming.md)
 
-By default, TLS is enabled:
+By default, TLS is enabled and must be configured under `tls`:
 
 - `insecure` (default = `false`): whether to enable client transport security for
   the exporter's connection.
@@ -31,11 +31,13 @@ Example:
 exporters:
   opencensus:
     endpoint: opencensus2:55678
-    cert_file: file.cert
-    key_file: file.key
-  otlp/2:
+    tls:
+      cert_file: file.cert
+      key_file: file.key
+  opencensus/2:
     endpoint: opencensus2:55678
-    insecure: true
+    tls:
+      insecure: true
 ```
 
 ## Advanced Configuration
diff --git a/exporter/zipkinexporter/README.md b/exporter/zipkinexporter/README.md
index 865cb20e0177..f2de6f5909b9 100644
--- a/exporter/zipkinexporter/README.md
+++ b/exporter/zipkinexporter/README.md
@@ -12,7 +12,7 @@ The following settings are required:
 - `endpoint` (no default): URL to which the exporter is going to send Zipkin trace data.
 - `format` (default = `JSON`): The format to sent events in. Can be set to `JSON` or `proto`.
 
-By default, TLS is enabled:
+By default, TLS is enabled and must be configured under `tls`:
 
 - `insecure` (default = `false`): whether to enable client transport security for
   the exporter's connection.
@@ -35,11 +35,13 @@ Example:
 exporters:
   zipkin:
     endpoint: "http://some.url:9411/api/v2/spans"
-    cert_file: file.cert
-    key_file: file.key
+    tls:
+      cert_file: file.cert
+      key_file: file.key
   zipkin/2:
     endpoint: "http://some.url:9411/api/v2/spans"
-    insecure: true
+    tls:
+      insecure: true
 ```
 
 ## Advanced Configuration
diff --git a/receiver/jaegerreceiver/README.md b/receiver/jaegerreceiver/README.md
index 58875946bab3..0ac3c985908a 100644
--- a/receiver/jaegerreceiver/README.md
+++ b/receiver/jaegerreceiver/README.md
@@ -78,7 +78,8 @@ receivers:
       grpc:
     remote_sampling:
       endpoint: "jaeger-collector:14250"
-      insecure: true
+      tls:
+        insecure: true
 ```
 
 Remote sampling can also be directly served by the collector by providing a