diff --git a/app/models/authenticator.rb b/app/models/authenticator.rb
index b7e432a2efe..2fbee39f0f9 100644
--- a/app/models/authenticator.rb
+++ b/app/models/authenticator.rb
@@ -14,7 +14,7 @@ def self.validate_config(config)
     if authenticator
       authenticator.validate_config
     else
-      [:mode, "authentication type, #{config[:mode].inspect}, invalid. Should be one of: #{valid_modes.join(", ")}"]
+      [[:mode, "authentication mode, #{config[:mode].inspect}, is invalid. Should be one of: #{valid_modes.join(", ")}"]]
     end
   end
 
diff --git a/app/models/authenticator/ldap.rb b/app/models/authenticator/ldap.rb
index 9b739847fd3..ed6b508df89 100644
--- a/app/models/authenticator/ldap.rb
+++ b/app/models/authenticator/ldap.rb
@@ -10,7 +10,7 @@ def self.authenticates_for
 
     def self.validate_config(config)
       if config[:ldaphost].blank?
-        [:ldaphost, "ldaphost can't be blank"]
+        [[:ldaphost, "ldaphost can't be blank"]]
       else
         []
       end
diff --git a/lib/vmdb/config/validator.rb b/lib/vmdb/config/validator.rb
index 7f09f932f58..1cfe178652e 100644
--- a/lib/vmdb/config/validator.rb
+++ b/lib/vmdb/config/validator.rb
@@ -31,7 +31,7 @@ def validate
               _log.debug("  Invalid: #{errors}")
               errors.each do |e|
                 key, msg = e
-                @errors[[k, key].join("_")] = msg
+                @errors[[k, key].join("-")] = msg
               end
               valid = false
             end
diff --git a/lib/vmdb/settings.rb b/lib/vmdb/settings.rb
index b58e2739e67..69d45add5f1 100644
--- a/lib/vmdb/settings.rb
+++ b/lib/vmdb/settings.rb
@@ -8,6 +8,8 @@ module Vmdb
   class Settings
     extend Vmdb::SettingsWalker::ClassMethods
 
+    class ConfigurationInvalid < StandardError; end
+
     PASSWORD_FIELDS = Vmdb::SettingsWalker::PASSWORD_FIELDS
     DUMP_LOG_FILE   = Rails.root.join("log/last_settings.txt").freeze
 
@@ -37,17 +39,28 @@ def self.activate
       VMDB::Config::Activator.new(::Settings).activate
     end
 
-    def self.validate
-      VMDB::Config::Validator.new(::Settings).validate
+    def self.validator(settings = ::Settings)
+      VMDB::Config::Validator.new(settings)
+    end
+    private_class_method :validator
+
+    def self.validate(settings = ::Settings)
+      validator(settings).validate
     end
 
     def self.valid?
-      validate.first
+      validator.valid?
     end
 
     def self.save!(resource, hash)
       new_settings = build_without_local(resource).load!.merge!(hash).to_hash
-      raise "configuration invalid" unless VMDB::Config::Validator.new(new_settings).valid?
+
+      valid, errors = validate(new_settings)
+      unless valid
+        message = errors.map { |k, v| "#{k}: #{v}" }.join("; ")
+        raise ConfigurationInvalid, message
+      end
+
       hash_for_parent = parent_settings_without_local(resource).load!.to_hash
       diff = HashDiffer.diff(hash_for_parent, new_settings)
       encrypt_passwords!(diff)
diff --git a/spec/lib/vmdb/settings_spec.rb b/spec/lib/vmdb/settings_spec.rb
index b3c34e4a0fc..a52ef1ee9e9 100644
--- a/spec/lib/vmdb/settings_spec.rb
+++ b/spec/lib/vmdb/settings_spec.rb
@@ -73,7 +73,7 @@
     it "does not allow invalid configuration values" do
       expect do
         described_class.save!(miq_server, :authentication => {:mode => "stuff"})
-      end.to raise_error(RuntimeError, "configuration invalid")
+      end.to raise_error(described_class::ConfigurationInvalid)
     end
 
     it "with a change" do