diff --git a/doc/soju.1.scd b/doc/soju.1.scd
index 4de01b8..f88fd4d 100644
--- a/doc/soju.1.scd
+++ b/doc/soju.1.scd
@@ -170,12 +170,12 @@ abbreviated form, for instance *network* can be abbreviated as *net* or just
 	Show SHA-1 and SHA-256 fingerprints for the certificate
 	currently used with the network.
 
-*certfp reset* <network name>
-	Disable SASL EXTERNAL authentication and remove stored certificate.
-
 *sasl set-plain* <network name> <username> <password>
 	Set SASL PLAIN credentials.
 
+*sasl reset* <network name>
+	Disable SASL authentication and remove stored credentials.
+
 *user create* -username <username> -password <password> [-admin]
 	Create a new soju user. Only admin users can create new accounts.
 
diff --git a/service.go b/service.go
index 4c6573a..bb368be 100644
--- a/service.go
+++ b/service.go
@@ -180,11 +180,6 @@ func init() {
 					desc:   "show fingerprints of certificate associated with the network",
 					handle: handleServiceCertfpFingerprints,
 				},
-				"reset": {
-					usage:  "<network name>",
-					desc:   "disable SASL EXTERNAL authentication and remove stored certificate",
-					handle: handleServiceCertfpReset,
-				},
 			},
 		},
 		"sasl": {
@@ -194,6 +189,11 @@ func init() {
 					desc:   "set SASL PLAIN credentials",
 					handle: handleServiceSASLSetPlain,
 				},
+				"reset": {
+					usage:  "<network name>",
+					desc:   "disable SASL authentication and remove stored credentials",
+					handle: handleServiceSASLReset,
+				},
 			},
 		},
 		"user": {
@@ -573,30 +573,6 @@ func handleServiceCertfpFingerprints(dc *downstreamConn, params []string) error
 	return nil
 }
 
-func handleServiceCertfpReset(dc *downstreamConn, params []string) error {
-	if len(params) != 1 {
-		return fmt.Errorf("expected exactly one argument")
-	}
-
-	net := dc.user.getNetwork(params[0])
-	if net == nil {
-		return fmt.Errorf("unknown network %q", params[0])
-	}
-
-	net.SASL.External.CertBlob = nil
-	net.SASL.External.PrivKeyBlob = nil
-
-	if net.SASL.Mechanism == "EXTERNAL" {
-		net.SASL.Mechanism = ""
-	}
-	if err := dc.srv.db.StoreNetwork(dc.user.Username, &net.Network); err != nil {
-		return err
-	}
-
-	sendServicePRIVMSG(dc, "certificate reset")
-	return nil
-}
-
 func handleServiceSASLSetPlain(dc *downstreamConn, params []string) error {
 	if len(params) != 3 {
 		return fmt.Errorf("expected exactly 3 arguments")
@@ -619,6 +595,30 @@ func handleServiceSASLSetPlain(dc *downstreamConn, params []string) error {
 	return nil
 }
 
+func handleServiceSASLReset(dc *downstreamConn, params []string) error {
+	if len(params) != 1 {
+		return fmt.Errorf("expected exactly one argument")
+	}
+
+	net := dc.user.getNetwork(params[0])
+	if net == nil {
+		return fmt.Errorf("unknown network %q", params[0])
+	}
+
+	net.SASL.Plain.Username = ""
+	net.SASL.Plain.Password = ""
+	net.SASL.External.CertBlob = nil
+	net.SASL.External.PrivKeyBlob = nil
+	net.SASL.Mechanism = ""
+
+	if err := dc.srv.db.StoreNetwork(dc.user.Username, &net.Network); err != nil {
+		return err
+	}
+
+	sendServicePRIVMSG(dc, "credentials reset")
+	return nil
+}
+
 func handlePasswordChange(dc *downstreamConn, params []string) error {
 	if len(params) != 1 {
 		return fmt.Errorf("expected exactly one argument")