diff --git a/lib/src/main/java/tech/relaycorp/relaydroid/endpoint/ThirdPartyEndpoint.kt b/lib/src/main/java/tech/relaycorp/relaydroid/endpoint/ThirdPartyEndpoint.kt
index d80e740c..1f79958d 100644
--- a/lib/src/main/java/tech/relaycorp/relaydroid/endpoint/ThirdPartyEndpoint.kt
+++ b/lib/src/main/java/tech/relaycorp/relaydroid/endpoint/ThirdPartyEndpoint.kt
@@ -14,28 +14,28 @@ import java.nio.ByteBuffer
 
 
 public sealed class ThirdPartyEndpoint(
-    public val thirdPartyAddress: String, // Private address
     public val identityCertificate: Certificate
 ) : Endpoint {
 
-    public companion object {
+    public val privateAddress : String get() = identityCertificate.subjectPrivateAddress
+
+    internal companion object {
         @Throws(PersistenceException::class)
         internal suspend fun load(
-            firstPartyAddress: String, thirdPartyAddress: String
+            firstPartyAddress: String, thirdPartyPrivateAddress: String
         ): ThirdPartyEndpoint? =
-            PublicThirdPartyEndpoint.load(thirdPartyAddress)
-                ?: PrivateThirdPartyEndpoint.load(firstPartyAddress, thirdPartyAddress)
+            PublicThirdPartyEndpoint.load(thirdPartyPrivateAddress)
+                ?: PrivateThirdPartyEndpoint.load(firstPartyAddress, thirdPartyPrivateAddress)
     }
 }
 
-public class PrivateThirdPartyEndpoint(
+public class PrivateThirdPartyEndpoint internal constructor(
     public val firstPartyAddress: String,
-    thirdPartyAddress: String,
     public val authorization: Certificate,
     identityCertificate: Certificate
-) : ThirdPartyEndpoint(thirdPartyAddress, identityCertificate) {
+) : ThirdPartyEndpoint(identityCertificate) {
 
-    override val address: String get() = thirdPartyAddress
+    override val address: String get() = privateAddress
 
     public companion object {
 
@@ -46,7 +46,7 @@ public class PrivateThirdPartyEndpoint(
             val key = "${firstPartyAddress}_$thirdPartyAddress"
             return Storage.thirdPartyAuthorization.get(key)?.let { auth ->
                 Storage.thirdPartyIdentityCertificate.get(key)?.let { id ->
-                    PrivateThirdPartyEndpoint(firstPartyAddress, thirdPartyAddress, auth, id)
+                    PrivateThirdPartyEndpoint(firstPartyAddress, auth, id)
                 }
             }
         }
@@ -56,7 +56,7 @@ public class PrivateThirdPartyEndpoint(
             UnknownFirstPartyEndpointException::class
         )
         public suspend fun importAuthorization(
-            pda: Certificate, identity: Certificate
+            pda: Certificate, identityCertificate: Certificate
         ): PrivateThirdPartyEndpoint {
             val firstPartyAddress = pda.subjectPrivateAddress
 
@@ -66,46 +66,51 @@ public class PrivateThirdPartyEndpoint(
                 )
 
             try {
-                pda.getCertificationPath(emptyList(), listOf(identity))
+                pda.getCertificationPath(emptyList(), listOf(identityCertificate))
             } catch (e: CertificateException) {
                 throw InvalidAuthorizationException("PDA was not issued by third-party endpoint", e)
             }
 
-            val thirdPartyAddress = identity.subjectPrivateAddress
+            val thirdPartyAddress = identityCertificate.subjectPrivateAddress
 
             val key = "${firstPartyAddress}_$thirdPartyAddress"
             Storage.thirdPartyAuthorization.set(key, pda)
-            Storage.thirdPartyIdentityCertificate.set(key, identity)
+            Storage.thirdPartyIdentityCertificate.set(key, identityCertificate)
 
-            return PrivateThirdPartyEndpoint(firstPartyAddress, thirdPartyAddress, pda, identity)
+            return PrivateThirdPartyEndpoint(firstPartyAddress, pda, identityCertificate)
         }
     }
 }
 
-public class PublicThirdPartyEndpoint(
+public class PublicThirdPartyEndpoint internal constructor(
     public val publicAddress: String,
-    thirdPartyAddress: String,
     identityCertificate: Certificate
-) : ThirdPartyEndpoint(thirdPartyAddress, identityCertificate) {
+) : ThirdPartyEndpoint(identityCertificate) {
 
     override val address: String get() = "https://$publicAddress"
 
     public companion object {
         @Throws(PersistenceException::class)
-        public suspend fun load(thirdPartyAddress: String): PublicThirdPartyEndpoint? =
-            Storage.publicThirdPartyCertificate.get(thirdPartyAddress)?.let {
-                PublicThirdPartyEndpoint(it.publicAddress, thirdPartyAddress, it.identityCertificate)
+        public suspend fun load(publicAddress: String): PublicThirdPartyEndpoint? =
+            Storage.publicThirdPartyCertificate.get(publicAddress)?.let {
+                PublicThirdPartyEndpoint(it.publicAddress, it.identityCertificate)
             }
 
         @Throws(
             PersistenceException::class,
             CertificateException::class
         )
-        public suspend fun import(publicAddress: String, certificate: Certificate): PublicThirdPartyEndpoint {
-            certificate.validate()
-            val thirdPartyAddress = certificate.subjectPrivateAddress
-            Storage.publicThirdPartyCertificate.set(thirdPartyAddress, StoredData(publicAddress, certificate))
-            return PublicThirdPartyEndpoint(publicAddress, thirdPartyAddress, certificate)
+        public suspend fun import(
+            publicAddress: String,
+            identityCertificate: Certificate
+        ): PublicThirdPartyEndpoint {
+            identityCertificate.validate()
+            val thirdPartyAddress = identityCertificate.subjectPrivateAddress
+            Storage.publicThirdPartyCertificate.set(
+                thirdPartyAddress,
+                StoredData(publicAddress, identityCertificate)
+            )
+            return PublicThirdPartyEndpoint(publicAddress, identityCertificate)
         }
     }
 
diff --git a/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PrivateThirdPartyEndpointTest.kt b/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PrivateThirdPartyEndpointTest.kt
index f96e8ca9..47f670b4 100644
--- a/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PrivateThirdPartyEndpointTest.kt
+++ b/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PrivateThirdPartyEndpointTest.kt
@@ -41,7 +41,7 @@ internal class PrivateThirdPartyEndpointTest {
 
         with(PrivateThirdPartyEndpoint.load(firstAddress, thirdAddress)!!) {
             assertEquals(firstAddress, firstPartyAddress)
-            assertEquals(thirdAddress, address)
+            assertEquals(PDACertPath.PRIVATE_ENDPOINT.subjectPrivateAddress, address)
             assertEquals(PDACertPath.PRIVATE_ENDPOINT, authorization)
             assertEquals(PDACertPath.PRIVATE_ENDPOINT, identityCertificate)
         }
diff --git a/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PublicThirdPartyEndpointTest.kt b/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PublicThirdPartyEndpointTest.kt
index a016a3a5..77f779fb 100644
--- a/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PublicThirdPartyEndpointTest.kt
+++ b/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/PublicThirdPartyEndpointTest.kt
@@ -8,8 +8,6 @@ import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
 import org.junit.Before
 import org.junit.Test
-import org.junit.runner.RunWith
-import org.robolectric.RobolectricTestRunner
 import tech.relaycorp.relaydroid.Relaynet
 import tech.relaycorp.relaydroid.storage.StorageImpl
 import tech.relaycorp.relaydroid.storage.mockStorage
@@ -37,7 +35,6 @@ internal class PublicThirdPartyEndpointTest {
             .thenReturn(PublicThirdPartyEndpoint.StoredData(publicAddress, PDACertPath.PUBLIC_GW))
 
         val endpoint = PublicThirdPartyEndpoint.load(privateAddress)!!
-        assertEquals(privateAddress, endpoint.thirdPartyAddress)
         assertEquals(publicAddress, endpoint.publicAddress)
         assertEquals("https://$publicAddress", endpoint.address)
         assertEquals(PDACertPath.PUBLIC_GW, endpoint.identityCertificate)
@@ -54,7 +51,6 @@ internal class PublicThirdPartyEndpointTest {
     fun import_successful() = runBlockingTest {
         val publicAddress = "example.org"
         with(PublicThirdPartyEndpoint.import(publicAddress, PDACertPath.PUBLIC_GW)) {
-            assertEquals(PDACertPath.PUBLIC_GW.subjectPrivateAddress, this.thirdPartyAddress)
             assertEquals(publicAddress, this.publicAddress)
             assertEquals(PDACertPath.PUBLIC_GW, identityCertificate)
             assertEquals("https://$publicAddress", this.address)
diff --git a/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/ThirdPartyEndpointTest.kt b/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/ThirdPartyEndpointTest.kt
new file mode 100644
index 00000000..bc658c4b
--- /dev/null
+++ b/lib/src/test/java/tech/relaycorp/relaydroid/endpoint/ThirdPartyEndpointTest.kt
@@ -0,0 +1,17 @@
+package tech.relaycorp.relaydroid.endpoint
+
+import org.junit.Assert.assertEquals
+import org.junit.Test
+import tech.relaycorp.relaynet.testing.pki.PDACertPath
+
+internal class ThirdPartyEndpointTest {
+    @Test
+    fun privateAddress() {
+        val endpoint = PublicThirdPartyEndpoint(
+            "example.com",
+            PDACertPath.PRIVATE_ENDPOINT
+        )
+
+        assertEquals(PDACertPath.PRIVATE_ENDPOINT.subjectPrivateAddress, endpoint.privateAddress)
+    }
+}
diff --git a/lib/src/test/java/tech/relaycorp/relaydroid/test/ThirdPartyEndpointFactory.kt b/lib/src/test/java/tech/relaycorp/relaydroid/test/ThirdPartyEndpointFactory.kt
index 9b54a9ab..46a111d4 100644
--- a/lib/src/test/java/tech/relaycorp/relaydroid/test/ThirdPartyEndpointFactory.kt
+++ b/lib/src/test/java/tech/relaycorp/relaydroid/test/ThirdPartyEndpointFactory.kt
@@ -15,12 +15,10 @@ internal object ThirdPartyEndpointFactory {
 
     fun buildPublic(): PublicThirdPartyEndpoint = PublicThirdPartyEndpoint(
         "example.org",
-        UUID.randomUUID().toString(),
         PDACertPath.PUBLIC_GW
     )
 
     fun buildPrivate(): PrivateThirdPartyEndpoint = PrivateThirdPartyEndpoint(
-        UUID.randomUUID().toString(),
         UUID.randomUUID().toString(),
         PDACertPath.PRIVATE_ENDPOINT,
         PDACertPath.PRIVATE_ENDPOINT