diff --git a/app/models/katello/concerns/smart_proxy_extensions.rb b/app/models/katello/concerns/smart_proxy_extensions.rb
index f16f2f3c259..3d5f59a81dc 100644
--- a/app/models/katello/concerns/smart_proxy_extensions.rb
+++ b/app/models/katello/concerns/smart_proxy_extensions.rb
@@ -256,9 +256,11 @@ def pulp3_ssl_configuration(config, connection_adapter = Faraday.default_adapter
         when :excon
           config.ssl_client_cert = ::Cert::Certs.ssl_client_cert_filename
           config.ssl_client_key = ::Cert::Certs.ssl_client_key_filename
+          config.ssl_ca_file = ::Cert::Certs.ca_cert_filename
         when :net_http
           config.ssl_client_cert = ::Cert::Certs.ssl_client_cert
           config.ssl_client_key = ::Cert::Certs.ssl_client_key
+          config.ssl_ca_file = ::Cert::Certs.ca_cert_filename
         else
           fail "Unexpected connection_adapter #{Faraday.default_adapter}!  Cannot continue, this is likely a bug."
         end
diff --git a/app/services/cert/certs.rb b/app/services/cert/certs.rb
index a611f8b5aa8..454fc11d0f1 100644
--- a/app/services/cert/certs.rb
+++ b/app/services/cert/certs.rb
@@ -4,8 +4,12 @@ def self.ueber_cert(organization)
       organization.debug_cert
     end
 
+    def self.ca_cert_filename
+      Setting[:ssl_ca_file]
+    end
+
     def self.ca_cert
-      File.read(Setting[:ssl_ca_file])
+      File.read(ca_cert_filename)
     end
 
     def self.candlepin_client_ca_cert