diff --git a/internal/configuration/sources/env/health.go b/internal/configuration/sources/env/health.go
index 81ebc3a9..0d322842 100644
--- a/internal/configuration/sources/env/health.go
+++ b/internal/configuration/sources/env/health.go
@@ -2,14 +2,13 @@ package env
 
 import (
 	"fmt"
-	"os"
 	"time"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 )
 
 func (r *Reader) ReadHealth() (health settings.Health, err error) {
-	health.ServerAddress = os.Getenv("HEALTH_SERVER_ADDRESS")
+	health.ServerAddress = getCleanedEnv("HEALTH_SERVER_ADDRESS")
 	_, health.TargetAddress = r.getEnvWithRetro("HEALTH_TARGET_ADDRESS", "HEALTH_ADDRESS_TO_PING")
 
 	health.VPN.Initial, err = r.readDurationWithRetro(
diff --git a/internal/configuration/sources/env/helpers.go b/internal/configuration/sources/env/helpers.go
index aa9826da..4e598133 100644
--- a/internal/configuration/sources/env/helpers.go
+++ b/internal/configuration/sources/env/helpers.go
@@ -12,8 +12,18 @@ import (
 	"github.com/qdm12/govalid/integer"
 )
 
+// getCleanedEnv returns an environment variable value with
+// surrounding spaces and trailing new line characters removed.
+func getCleanedEnv(envKey string) (value string) {
+	value = os.Getenv(envKey)
+	value = strings.TrimSpace(value)
+	value = strings.TrimSuffix(value, "\r\n")
+	value = strings.TrimSuffix(value, "\n")
+	return value
+}
+
 func envToCSV(envKey string) (values []string) {
-	csv := os.Getenv(envKey)
+	csv := getCleanedEnv(envKey)
 	if csv == "" {
 		return nil
 	}
@@ -21,7 +31,7 @@ func envToCSV(envKey string) (values []string) {
 }
 
 func envToInt(envKey string) (n int, err error) {
-	s := os.Getenv(envKey)
+	s := getCleanedEnv(envKey)
 	if s == "" {
 		return 0, nil
 	}
@@ -29,7 +39,7 @@ func envToInt(envKey string) (n int, err error) {
 }
 
 func envToStringPtr(envKey string) (stringPtr *string) {
-	s := os.Getenv(envKey)
+	s := getCleanedEnv(envKey)
 	if s == "" {
 		return nil
 	}
@@ -37,7 +47,7 @@ func envToStringPtr(envKey string) (stringPtr *string) {
 }
 
 func envToBoolPtr(envKey string) (boolPtr *bool, err error) {
-	s := os.Getenv(envKey)
+	s := getCleanedEnv(envKey)
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
@@ -49,7 +59,7 @@ func envToBoolPtr(envKey string) (boolPtr *bool, err error) {
 }
 
 func envToIntPtr(envKey string) (intPtr *int, err error) {
-	s := os.Getenv(envKey)
+	s := getCleanedEnv(envKey)
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
@@ -61,7 +71,7 @@ func envToIntPtr(envKey string) (intPtr *int, err error) {
 }
 
 func envToUint8Ptr(envKey string) (uint8Ptr *uint8, err error) {
-	s := os.Getenv(envKey)
+	s := getCleanedEnv(envKey)
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
@@ -78,7 +88,7 @@ func envToUint8Ptr(envKey string) (uint8Ptr *uint8, err error) {
 }
 
 func envToUint16Ptr(envKey string) (uint16Ptr *uint16, err error) {
-	s := os.Getenv(envKey)
+	s := getCleanedEnv(envKey)
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
@@ -95,7 +105,7 @@ func envToUint16Ptr(envKey string) (uint16Ptr *uint16, err error) {
 }
 
 func envToDurationPtr(envKey string) (durationPtr *time.Duration, err error) {
-	s := os.Getenv(envKey)
+	s := getCleanedEnv(envKey)
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/helpers_test.go b/internal/configuration/sources/env/helpers_test.go
index c5dba032..9c60657f 100644
--- a/internal/configuration/sources/env/helpers_test.go
+++ b/internal/configuration/sources/env/helpers_test.go
@@ -20,7 +20,3 @@ func setTestEnv(t *testing.T, key, value string) {
 	})
 	require.NoError(t, err)
 }
-
-func TestXxx(t *testing.T) {
-	t.Log(int(^uint32(0)))
-}
diff --git a/internal/configuration/sources/env/log.go b/internal/configuration/sources/env/log.go
index 0ef65338..c5609fb2 100644
--- a/internal/configuration/sources/env/log.go
+++ b/internal/configuration/sources/env/log.go
@@ -3,7 +3,6 @@ package env
 import (
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -20,7 +19,7 @@ func readLog() (log settings.Log, err error) {
 }
 
 func readLogLevel() (level *log.Level, err error) {
-	s := os.Getenv("LOG_LEVEL")
+	s := getCleanedEnv("LOG_LEVEL")
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/openvpn.go b/internal/configuration/sources/env/openvpn.go
index e6285081..a0499bdc 100644
--- a/internal/configuration/sources/env/openvpn.go
+++ b/internal/configuration/sources/env/openvpn.go
@@ -2,7 +2,6 @@ package env
 
 import (
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -15,10 +14,10 @@ func (r *Reader) readOpenVPN() (
 		err = unsetEnvKeys([]string{"OPENVPN_CLIENTKEY", "OPENVPN_CLIENTCRT"}, err)
 	}()
 
-	openVPN.Version = os.Getenv("OPENVPN_VERSION")
+	openVPN.Version = getCleanedEnv("OPENVPN_VERSION")
 	openVPN.User = r.readOpenVPNUser()
 	openVPN.Password = r.readOpenVPNPassword()
-	confFile := os.Getenv("OPENVPN_CUSTOM_CONFIG")
+	confFile := getCleanedEnv("OPENVPN_CUSTOM_CONFIG")
 	if confFile != "" {
 		openVPN.ConfFile = &confFile
 	}
@@ -26,7 +25,7 @@ func (r *Reader) readOpenVPN() (
 	ciphersKey, _ := r.getEnvWithRetro("OPENVPN_CIPHERS", "OPENVPN_CIPHER")
 	openVPN.Ciphers = envToCSV(ciphersKey)
 
-	auth := os.Getenv("OPENVPN_AUTH")
+	auth := getCleanedEnv("OPENVPN_AUTH")
 	if auth != "" {
 		openVPN.Auth = &auth
 	}
@@ -65,7 +64,7 @@ func (r *Reader) readOpenVPN() (
 		return openVPN, fmt.Errorf("environment variable OPENVPN_VERBOSITY: %w", err)
 	}
 
-	flagsStr := os.Getenv("OPENVPN_FLAGS")
+	flagsStr := getCleanedEnv("OPENVPN_FLAGS")
 	if flagsStr != "" {
 		openVPN.Flags = strings.Fields(flagsStr)
 	}
@@ -85,7 +84,7 @@ func (r *Reader) readOpenVPNPassword() (password string) {
 }
 
 func readBase64OrNil(envKey string) (valueOrNil *string, err error) {
-	value := os.Getenv(envKey)
+	value := getCleanedEnv(envKey)
 	if value == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/openvpnselection.go b/internal/configuration/sources/env/openvpnselection.go
index 4b59dd12..f92321c2 100644
--- a/internal/configuration/sources/env/openvpnselection.go
+++ b/internal/configuration/sources/env/openvpnselection.go
@@ -3,7 +3,6 @@ package env
 import (
 	"errors"
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -13,7 +12,7 @@ import (
 
 func (r *Reader) readOpenVPNSelection() (
 	selection settings.OpenVPNSelection, err error) {
-	confFile := os.Getenv("OPENVPN_CUSTOM_CONFIG")
+	confFile := getCleanedEnv("OPENVPN_CUSTOM_CONFIG")
 	if confFile != "" {
 		selection.ConfFile = &confFile
 	}
diff --git a/internal/configuration/sources/env/pprof.go b/internal/configuration/sources/env/pprof.go
index 5ab659c9..43fddeac 100644
--- a/internal/configuration/sources/env/pprof.go
+++ b/internal/configuration/sources/env/pprof.go
@@ -2,7 +2,6 @@ package env
 
 import (
 	"fmt"
-	"os"
 
 	"github.com/qdm12/gluetun/internal/pprof"
 )
@@ -23,7 +22,7 @@ func readPprof() (settings pprof.Settings, err error) {
 		return settings, fmt.Errorf("environment variable PPROF_MUTEX_PROFILE_RATE: %w", err)
 	}
 
-	settings.HTTPServer.Address = os.Getenv("PPROF_HTTP_SERVER_ADDRESS")
+	settings.HTTPServer.Address = getCleanedEnv("PPROF_HTTP_SERVER_ADDRESS")
 
 	return settings, nil
 }
diff --git a/internal/configuration/sources/env/provider.go b/internal/configuration/sources/env/provider.go
index 8cc498e3..5a56896c 100644
--- a/internal/configuration/sources/env/provider.go
+++ b/internal/configuration/sources/env/provider.go
@@ -2,7 +2,6 @@ package env
 
 import (
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -35,7 +34,7 @@ func (r *Reader) readVPNServiceProvider(vpnType string) (vpnProviderPtr *string)
 	s = strings.ToLower(s)
 	switch {
 	case vpnType != vpn.Wireguard &&
-		os.Getenv("OPENVPN_CUSTOM_CONFIG") != "": // retro compatibility
+		getCleanedEnv("OPENVPN_CUSTOM_CONFIG") != "": // retro compatibility
 		return stringPtr(providers.Custom)
 	case s == "":
 		return nil
diff --git a/internal/configuration/sources/env/publicip.go b/internal/configuration/sources/env/publicip.go
index 7d46d7eb..d0da77e5 100644
--- a/internal/configuration/sources/env/publicip.go
+++ b/internal/configuration/sources/env/publicip.go
@@ -2,7 +2,6 @@ package env
 
 import (
 	"fmt"
-	"os"
 	"time"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -20,7 +19,7 @@ func (r *Reader) readPublicIP() (publicIP settings.PublicIP, err error) {
 }
 
 func readPublicIPPeriod() (period *time.Duration, err error) {
-	s := os.Getenv("PUBLICIP_PERIOD")
+	s := getCleanedEnv("PUBLICIP_PERIOD")
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/reader.go b/internal/configuration/sources/env/reader.go
index 64ea301e..17b64a44 100644
--- a/internal/configuration/sources/env/reader.go
+++ b/internal/configuration/sources/env/reader.go
@@ -1,8 +1,6 @@
 package env
 
 import (
-	"os"
-
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/gluetun/internal/configuration/sources"
 )
@@ -111,12 +109,12 @@ func (r *Reader) getEnvWithRetro(currentKey string,
 	// We check retro-compatibility keys first since
 	// the current key might be set in the Dockerfile.
 	for _, key = range retroKeys {
-		value = os.Getenv(key)
+		value = getCleanedEnv(key)
 		if value != "" {
 			r.onRetroActive(key, currentKey)
 			return key, value
 		}
 	}
 
-	return currentKey, os.Getenv(currentKey)
+	return currentKey, getCleanedEnv(currentKey)
 }
diff --git a/internal/configuration/sources/env/server.go b/internal/configuration/sources/env/server.go
index 336a44b1..bed9ebce 100644
--- a/internal/configuration/sources/env/server.go
+++ b/internal/configuration/sources/env/server.go
@@ -2,7 +2,6 @@ package env
 
 import (
 	"fmt"
-	"os"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/govalid/binary"
@@ -20,7 +19,7 @@ func (r *Reader) readControlServer() (controlServer settings.ControlServer, err
 }
 
 func readControlServerLog() (enabled *bool, err error) {
-	s := os.Getenv("HTTP_CONTROL_SERVER_LOG")
+	s := getCleanedEnv("HTTP_CONTROL_SERVER_LOG")
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/serverselection.go b/internal/configuration/sources/env/serverselection.go
index 26cba00e..4c1cf2d1 100644
--- a/internal/configuration/sources/env/serverselection.go
+++ b/internal/configuration/sources/env/serverselection.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"fmt"
 	"net"
-	"os"
 	"strconv"
 	"strings"
 
@@ -49,7 +48,7 @@ func (r *Reader) readServerSelection(vpnProvider, vpnType string) (
 	serverNamesKey, _ := r.getEnvWithRetro("SERVER_NAMES", "SERVER_NAME")
 	ss.Names = envToCSV(serverNamesKey)
 
-	if csv := os.Getenv("SERVER_NUMBER"); csv != "" {
+	if csv := getCleanedEnv("SERVER_NUMBER"); csv != "" {
 		numbersStrings := strings.Split(csv, ",")
 		numbers := make([]uint16, len(numbersStrings))
 		for i, numberString := range numbersStrings {
diff --git a/internal/configuration/sources/env/system.go b/internal/configuration/sources/env/system.go
index faec674a..8085d6ee 100644
--- a/internal/configuration/sources/env/system.go
+++ b/internal/configuration/sources/env/system.go
@@ -3,7 +3,6 @@ package env
 import (
 	"errors"
 	"fmt"
-	"os"
 	"strconv"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -26,7 +25,7 @@ func (r *Reader) readSystem() (system settings.System, err error) {
 		return system, err
 	}
 
-	system.Timezone = os.Getenv("TZ")
+	system.Timezone = getCleanedEnv("TZ")
 
 	return system, nil
 }
diff --git a/internal/configuration/sources/env/updater.go b/internal/configuration/sources/env/updater.go
index 061f7458..e7645bb4 100644
--- a/internal/configuration/sources/env/updater.go
+++ b/internal/configuration/sources/env/updater.go
@@ -3,7 +3,6 @@ package env
 import (
 	"fmt"
 	"net"
-	"os"
 	"time"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
@@ -26,7 +25,7 @@ func readUpdater() (updater settings.Updater, err error) {
 }
 
 func readUpdaterPeriod() (period *time.Duration, err error) {
-	s := os.Getenv("UPDATER_PERIOD")
+	s := getCleanedEnv("UPDATER_PERIOD")
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/version.go b/internal/configuration/sources/env/version.go
index 3e1e688c..ceff787f 100644
--- a/internal/configuration/sources/env/version.go
+++ b/internal/configuration/sources/env/version.go
@@ -2,7 +2,6 @@ package env
 
 import (
 	"fmt"
-	"os"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/govalid/binary"
@@ -18,7 +17,7 @@ func readVersion() (version settings.Version, err error) {
 }
 
 func readVersionEnabled() (enabled *bool, err error) {
-	s := os.Getenv("VERSION_INFORMATION")
+	s := getCleanedEnv("VERSION_INFORMATION")
 	if s == "" {
 		return nil, nil //nolint:nilnil
 	}
diff --git a/internal/configuration/sources/env/vpn.go b/internal/configuration/sources/env/vpn.go
index c09ee111..e11cc31b 100644
--- a/internal/configuration/sources/env/vpn.go
+++ b/internal/configuration/sources/env/vpn.go
@@ -2,14 +2,13 @@ package env
 
 import (
 	"fmt"
-	"os"
 	"strings"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 )
 
 func (r *Reader) readVPN() (vpn settings.VPN, err error) {
-	vpn.Type = strings.ToLower(os.Getenv("VPN_TYPE"))
+	vpn.Type = strings.ToLower(getCleanedEnv("VPN_TYPE"))
 
 	vpn.Provider, err = r.readProvider(vpn.Type)
 	if err != nil {
diff --git a/internal/configuration/sources/env/wireguardselection.go b/internal/configuration/sources/env/wireguardselection.go
index 4b8c87af..59c7f67e 100644
--- a/internal/configuration/sources/env/wireguardselection.go
+++ b/internal/configuration/sources/env/wireguardselection.go
@@ -4,7 +4,6 @@ import (
 	"errors"
 	"fmt"
 	"net"
-	"os"
 
 	"github.com/qdm12/gluetun/internal/configuration/settings"
 	"github.com/qdm12/govalid/port"
@@ -22,7 +21,7 @@ func (r *Reader) readWireguardSelection() (
 		return selection, err
 	}
 
-	selection.PublicKey = os.Getenv("WIREGUARD_PUBLIC_KEY")
+	selection.PublicKey = getCleanedEnv("WIREGUARD_PUBLIC_KEY")
 
 	return selection, nil
 }
diff --git a/internal/configuration/sources/secrets/helpers.go b/internal/configuration/sources/secrets/helpers.go
index 043d899f..905a9c99 100644
--- a/internal/configuration/sources/secrets/helpers.go
+++ b/internal/configuration/sources/secrets/helpers.go
@@ -2,13 +2,24 @@ package secrets
 
 import (
 	"os"
+	"strings"
 
 	"github.com/qdm12/gluetun/internal/configuration/sources/files"
 )
 
+// getCleanedEnv returns an environment variable value with
+// surrounding spaces and trailing new line characters removed.
+func getCleanedEnv(envKey string) (value string) {
+	value = os.Getenv(envKey)
+	value = strings.TrimSpace(value)
+	value = strings.TrimSuffix(value, "\r\n")
+	value = strings.TrimSuffix(value, "\n")
+	return value
+}
+
 func readSecretFileAsStringPtr(secretPathEnvKey, defaultSecretPath string) (
 	stringPtr *string, err error) {
-	path := os.Getenv(secretPathEnvKey)
+	path := getCleanedEnv(secretPathEnvKey)
 	if path == "" {
 		path = defaultSecretPath
 	}
@@ -17,7 +28,7 @@ func readSecretFileAsStringPtr(secretPathEnvKey, defaultSecretPath string) (
 
 func readSecretFileAsString(secretPathEnvKey, defaultSecretPath string) (
 	s string, err error) {
-	path := os.Getenv(secretPathEnvKey)
+	path := getCleanedEnv(secretPathEnvKey)
 	if path == "" {
 		path = defaultSecretPath
 	}