diff --git a/common/clients.py b/common/clients.py
index 85bfea5..acbf239 100644
--- a/common/clients.py
+++ b/common/clients.py
@@ -79,6 +79,8 @@
             raise ValueError(_('Incorrectly specified auth_url config: no '
                                'version found.'))
 
+        self.insecure = self.conf.disable_ssl_certificate_validation
+        self.ca_file = self.conf.ca_file
         self.identity_client = self._get_identity_client()
         self.orchestration_client = self._get_orchestration_client()
         self.compute_client = self._get_compute_client()
@@ -121,13 +123,15 @@
                 'project_domain_name': domain,
                 'user_domain_name': domain})
         auth = password.Password(**kwargs)
-        return KeystoneWrapperClient(
-            auth,
-            not self.conf.disable_ssl_certificate_validation)
+        if self.insecure:
+            verify_cert = False
+        else:
+            verify_cert = self.ca_file or True
+
+        return KeystoneWrapperClient(auth, verify_cert)
 
     def _get_compute_client(self):
 
-        dscv = self.conf.disable_ssl_certificate_validation
         region = self.conf.region
 
         client_args = (
@@ -146,11 +150,11 @@
             endpoint_type='publicURL',
             region_name=region,
             no_cache=True,
-            insecure=dscv,
+            insecure=self.insecure,
+            cacert=self.ca_file,
             http_log_debug=True)
 
     def _get_network_client(self):
-        dscv = self.conf.disable_ssl_certificate_validation
 
         return neutron_client.Client(
             username=self.conf.username,
@@ -159,12 +163,12 @@
             endpoint_type='publicURL',
             # neutronclient can not use v3 url
             auth_url=self.v2_auth_url,
-            insecure=dscv)
+            insecure=self.insecure,
+            ca_cert=self.ca_file)
 
     def _get_volume_client(self):
         region = self.conf.region
         endpoint_type = 'publicURL'
-        dscv = self.conf.disable_ssl_certificate_validation
         return cinder_client.Client(
             self.CINDERCLIENT_VERSION,
             self.conf.username,
@@ -174,11 +178,11 @@
             self.v2_auth_url,
             region_name=region,
             endpoint_type=endpoint_type,
-            insecure=dscv,
+            insecure=self.insecure,
+            cacert=self.ca_file,
             http_log_debug=True)
 
     def _get_object_client(self):
-        dscv = self.conf.disable_ssl_certificate_validation
         args = {
             'auth_version': self.auth_version,
             'tenant_name': self.conf.tenant_name,
@@ -186,12 +190,12 @@
             'key': self.conf.password,
             'authurl': self.conf.auth_url,
             'os_options': {'endpoint_type': 'publicURL'},
-            'insecure': dscv,
+            'insecure': self.insecure,
+            'cacert': self.ca_file,
         }
         return swift_client.Connection(**args)
 
     def _get_metering_client(self):
-        dscv = self.conf.disable_ssl_certificate_validation
         domain = self.conf.domain_name
         try:
             endpoint = self.identity_client.get_endpoint_url('metering',
@@ -204,7 +208,8 @@
                 'password': self.conf.password,
                 'tenant_name': self.conf.tenant_name,
                 'auth_url': self.conf.auth_url,
-                'insecure': dscv,
+                'insecure': self.insecure,
+                'cacert': self.ca_file,
                 'region_name': self.conf.region,
                 'endpoint_type': 'publicURL',
                 'service_type': 'metering',
diff --git a/common/config.py b/common/config.py
index 6d35600..f8ae075 100644
--- a/common/config.py
+++ b/common/config.py
@@ -60,6 +60,10 @@
     cfg.BoolOpt('disable_ssl_certificate_validation',
                 default=False,
                 help="Set to True if using self-signed SSL certificates."),
+    cfg.StrOpt('ca_file',
+               default=None,
+               help="CA certificate to pass for servers that have "
+                    "https endpoint."),
     cfg.IntOpt('build_interval',
                default=4,
                help="Time in seconds between build status checks."),
diff --git a/common/test.py b/common/test.py
index 4eaa2b7..42fa43c 100644
--- a/common/test.py
+++ b/common/test.py
@@ -92,6 +92,10 @@
         self.metering_client = self.manager.metering_client
         self.useFixture(fixtures.FakeLogger(format=_LOG_FORMAT))
         self.updated_time = {}
+        if self.conf.disable_ssl_certificate_validation:
+            self.verify_cert = False
+        else:
+            self.verify_cert = self.conf.ca_file or True
 
     def get_remote_client(self, server_or_ip, username, private_key=None):
         if isinstance(server_or_ip, six.string_types):