diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 9bd4c3125c7..54551f8c666 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -6,7 +6,10 @@ TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
 ESCAPE_QUOTE="'\''"
 
 extract_field() {
-    echo $(echo $1 | jq -r $2)
+    if [ -z "$1" ]; then
+        return
+    fi
+    jq -r "$2" <<< "$1"
 }
 
 if [ ! -f "$TELEMETRY_VARS_FILE" ]; then
@@ -18,46 +21,59 @@ fi
 # Use default value if no valid config exists
 TELEMETRY_VARS=$(sonic-cfggen -d -t $TELEMETRY_VARS_FILE)
 TELEMETRY_VARS=${TELEMETRY_VARS//[\']/\"}
-X509=$(echo $TELEMETRY_VARS | jq -r '.x509')
-GNMI=$(echo $TELEMETRY_VARS | jq -r '.gnmi')
-CERTS=$(echo $TELEMETRY_VARS | jq -r '.certs')
+X509=$(jq -r '.x509 // empty' <<< "$TELEMETRY_VARS")
+GNMI=$(jq -r '.gnmi // empty' <<< "$TELEMETRY_VARS")
+CERTS=$(jq -r '.certs // empty' <<< "$TELEMETRY_VARS")
 
 # Enable GRPC GO LOG
 export GRPC_GO_LOG_VERBOSITY_LEVEL=99
 export GRPC_GO_LOG_SEVERITY_LEVEL=info
 
 TELEMETRY_ARGS=" -logtostderr"
+USE_EPHEMERAL_TLS=false
+CERTIFICATE_FREE_TLS=false
+HAS_CLIENT_CA=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 
 if [ -n "$CERTS" ]; then
-    SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
-    SERVER_KEY=$(extract_field "$CERTS" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    SERVER_CRT=$(extract_field "$CERTS" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$CERTS" '.server_key // empty')
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$CERTS" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 
 elif [ -n "$X509" ]; then
-    SERVER_CRT=$(extract_field "$X509" '.server_crt')
-    SERVER_KEY=$(extract_field "$X509" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    SERVER_CRT=$(extract_field "$X509" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$X509" '.server_key // empty')
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$X509" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 else
-    TELEMETRY_ARGS+=" --noTLS --bind_address 127.0.0.1"
+    TELEMETRY_ARGS+=" --insecure"
+    USE_EPHEMERAL_TLS=true
+    CERTIFICATE_FREE_TLS=true
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
@@ -73,8 +89,8 @@ fi
 
 TELEMETRY_ARGS+=" --port $PORT"
 
-CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
+CLIENT_AUTH=$(extract_field "$GNMI" 'if .client_auth == null then empty else .client_auth end')
+if [ "$CERTIFICATE_FREE_TLS" == "true" ] || [ "$CLIENT_AUTH" == "false" ] || { [ -z "$CLIENT_AUTH" ] && [ "$HAS_CLIENT_CA" == "false" ]; }; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 
@@ -128,19 +144,26 @@ else
     fi
 fi
 
-USER_AUTH=$(extract_field "$GNMI" '.user_auth')
+USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
 # If user_auth is not set, default to certs
-if [ $USER_AUTH == "null" ]; then
+if [ -z "$USER_AUTH" ]; then
     USER_AUTH="cert"
 fi
-if [ ! -z "$USER_AUTH" ] && [  $USER_AUTH != "null" ] && [  $USER_AUTH != "none" ]; then
+USER_AUTH=$(tr -d '[:space:]' <<< "$USER_AUTH")
+if [ "$CERTIFICATE_FREE_TLS" == "true" ]; then
+    USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
+    if [ -z "$USER_AUTH" ]; then
+        USER_AUTH="none"
+    fi
+fi
+if [ -n "$USER_AUTH" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
 
-    if [ $USER_AUTH == "cert" ]; then
+    if [[ ",$USER_AUTH," == *,cert,* ]]; then
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
-        ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
-        if [ $ENABLE_CRL == "true" ]; then
+        ENABLE_CRL=$(extract_field "$GNMI" '.enable_crl // false')
+        if [ "$ENABLE_CRL" == "true" ]; then
             TELEMETRY_ARGS+=" --enable_crl"
         fi
 
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 6c215651bff..097ddc8bb46 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -27,7 +27,10 @@ TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
 ESCAPE_QUOTE="'\''"
 
 extract_field() {
-    echo $(echo $1 | jq -r $2)
+    if [ -z "$1" ]; then
+        return
+    fi
+    jq -r "$2" <<< "$1"
 }
 
 if [ ! -f "$TELEMETRY_VARS_FILE" ]; then
@@ -39,45 +42,58 @@ fi
 # Use default value if no valid config exists
 TELEMETRY_VARS=$(sonic-cfggen -d -t $TELEMETRY_VARS_FILE)
 TELEMETRY_VARS=${TELEMETRY_VARS//[\']/\"}
-X509=$(echo $TELEMETRY_VARS | jq -r '.x509')
-GNMI=$(echo $TELEMETRY_VARS | jq -r '.gnmi')
-CERTS=$(echo $TELEMETRY_VARS | jq -r '.certs')
+X509=$(jq -r '.x509 // empty' <<< "$TELEMETRY_VARS")
+GNMI=$(jq -r '.gnmi // empty' <<< "$TELEMETRY_VARS")
+CERTS=$(jq -r '.certs // empty' <<< "$TELEMETRY_VARS")
 
 export GRPC_GO_LOG_VERBOSITY_LEVEL=99
 export GRPC_GO_LOG_SEVERITY_LEVEL=info
 
 TELEMETRY_ARGS=" -logtostderr"
+USE_EPHEMERAL_TLS=false
+CERTIFICATE_FREE_TLS=false
+HAS_CLIENT_CA=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 export GOTRACEBACK=crash
 
 if [ -n "$CERTS" ]; then
-    SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
-    SERVER_KEY=$(extract_field "$CERTS" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    SERVER_CRT=$(extract_field "$CERTS" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$CERTS" '.server_key // empty')
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$CERTS" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 elif [ -n "$X509" ]; then
-    SERVER_CRT=$(extract_field "$X509" '.server_crt')
-    SERVER_KEY=$(extract_field "$X509" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    SERVER_CRT=$(extract_field "$X509" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$X509" '.server_key // empty')
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$X509" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 else
-    TELEMETRY_ARGS+=" --noTLS --bind_address 127.0.0.1"
+    TELEMETRY_ARGS+=" --insecure"
+    USE_EPHEMERAL_TLS=true
+    CERTIFICATE_FREE_TLS=true
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
@@ -92,8 +108,8 @@ else
 fi
 TELEMETRY_ARGS+=" --port $PORT"
 
-CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
+CLIENT_AUTH=$(extract_field "$GNMI" 'if .client_auth == null then empty else .client_auth end')
+if [ "$CERTIFICATE_FREE_TLS" == "true" ] || [ "$CLIENT_AUTH" == "false" ] || { [ -z "$CLIENT_AUTH" ] && [ "$HAS_CLIENT_CA" == "false" ]; }; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 
@@ -139,16 +155,23 @@ else
 fi
 TELEMETRY_ARGS+=" -gnmi_native_write=false"
 
-USER_AUTH=$(extract_field "$GNMI" '.user_auth')
-if [ ! -z "$USER_AUTH" ] && [  $USER_AUTH != "null" ]; then
+USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
+USER_AUTH=$(tr -d '[:space:]' <<< "$USER_AUTH")
+if [ "$CERTIFICATE_FREE_TLS" == "true" ]; then
+    USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
+    if [ -z "$USER_AUTH" ]; then
+        USER_AUTH="none"
+    fi
+fi
+if [ -n "$USER_AUTH" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
 
-    if [ $USER_AUTH == "cert" ]; then
+    if [[ ",$USER_AUTH," == *,cert,* ]]; then
         # Reuse GNMI_CLIENT_CERT for telemetry service
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
-        ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
-        if [ $ENABLE_CRL == "true" ]; then
+        ENABLE_CRL=$(extract_field "$GNMI" '.enable_crl // false')
+        if [ "$ENABLE_CRL" == "true" ]; then
             TELEMETRY_ARGS+=" --enable_crl"
         fi
 
diff --git a/src/sonic-gnmi b/src/sonic-gnmi
index b1aa537b842..835b6b43c69 160000
--- a/src/sonic-gnmi
+++ b/src/sonic-gnmi
@@ -1 +1 @@
-Subproject commit b1aa537b84235971af1d6f5740c782f5f541298b
+Subproject commit 835b6b43c691c0984f0004a03e6397bb31b17769
diff --git a/src/sonic-host-services b/src/sonic-host-services
index 0c3c0550ff6..798f9d1e773 160000
--- a/src/sonic-host-services
+++ b/src/sonic-host-services
@@ -1 +1 @@
-Subproject commit 0c3c0550ff67b90358681ff0cc579fba187c93e2
+Subproject commit 798f9d1e77308d8b06aaed87af3af39740ae6e47
diff --git a/src/sonic-utilities b/src/sonic-utilities
index 9f5ee85c8cf..56d9bc760e2 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 9f5ee85c8cf79657259a954830fb75862c13e492
+Subproject commit 56d9bc760e294021a769303619d9005aebfec6a9