diff --git a/src/sbbs3/scfg/scfgsys.c b/src/sbbs3/scfg/scfgsys.c
index cabb85dd733511b5ddc292816ceb64a14e6524cd..84d108a29f58b3afd691199fdd4b090662e7d4b0 100644
--- a/src/sbbs3/scfg/scfgsys.c
+++ b/src/sbbs3/scfg/scfgsys.c
@@ -75,6 +75,19 @@ void sys_cfg(void)
 	static int sys_dflt,adv_dflt,tog_dflt,new_dflt;
 	char str[81],done=0;
 	int i,j,k,dflt,bar;
+	char sys_pass[sizeof(cfg.sys_pass)];
+	SAFECOPY(sys_pass, cfg.sys_pass);
+	char* cryptlib_syspass_helpbuf =
+		"`Changing the System Password requires new Cryptlib key and certificate:`\n"
+		"\n"
+		"The Cryptlib private key (`cryptlib.key`) and TLS certificate (`ssl.cert`)\n"
+		"files, located in the Synchronet `ctrl` directory, are encrypted with the\n"
+		"current `System Password`.\n"
+		"\n"
+		"Changing the System Password will require that the Cryptlib Private Key\n"
+		"and Certificate files be regenerated.  The Cryptlib key and certificate\n"
+		"regeneration should occur automatically after the files are deleted and\n"
+		"the Synchronet servers are recycled.";
 
 	while(1) {
 		i=0;
@@ -125,6 +138,16 @@ void sys_cfg(void)
 					break;
 				if(!i) {
 					cfg.new_install=new_install;
+					if(strcmp(sys_pass, cfg.sys_pass) != 0) {
+						uifc.helpbuf = cryptlib_syspass_helpbuf;
+						if((fexist("ssl.cert") || fexist("cryptlib.key"))
+							&& uifc.confirm("System Password Changed. Delete Cryptlib Key and Certificate?")) {
+							if(remove("ssl.cert") != 0)
+								uifc.msgf("Error %d removing ssl.cert", errno);
+							if(remove("cryptlib.key") != 0)
+								uifc.msgf("Error %d removing cryptlib.key", errno);
+						}
+					}
 					save_main_cfg(&cfg,backup_level);
 					refresh_cfg(&cfg);
 				}
@@ -373,6 +396,9 @@ void sys_cfg(void)
 				uifc.input(WIN_MID,0,0,"System Operator",cfg.sys_op,sizeof(cfg.sys_op)-1,K_EDIT);
 				break;
 			case 4:
+				uifc.helpbuf=cryptlib_syspass_helpbuf;
+				if(uifc.deny("Changing SysPass requires new Cryptlib key/cert. Continue?"))
+					break;
 				uifc.helpbuf=
 					"`System Password:`\n"
 					"\n"