diff --git a/lib/hammer_cli_foreman/auth_source_ldap.rb b/lib/hammer_cli_foreman/auth_source_ldap.rb
index 1a8367c91..41b23a882 100644
--- a/lib/hammer_cli_foreman/auth_source_ldap.rb
+++ b/lib/hammer_cli_foreman/auth_source_ldap.rb
@@ -4,6 +4,15 @@ class AuthSourceLdap < HammerCLIForeman::Command
     command_name 'ldap'
     desc _('Manage LDAP auth sources')
 
+    module CacertFileOption
+      def self.included(base)
+        base.option '--cacert-file', 'CACERT_FILE',
+                    _('Path to a PEM file with CA certificate(s) added to the system trust store for LDAPS verification'),
+                    :attribute_name => :option_cacert,
+                    :format => HammerCLI::Options::Normalizers::File.new
+      end
+    end
+
     class ListCommand < HammerCLIForeman::ListCommand
       output do
         field :id, _('Id')
@@ -23,6 +32,7 @@ class InfoCommand < HammerCLIForeman::InfoCommand
           field :name, _('Name')
           field :host, _('Server')
           field :tls, _('LDAPS'), Fields::Boolean
+          field :cacert, _('CA certificate'), Fields::LongText, :hide_blank => true
           field :port, _('Port')
           field :server_type, _('Server Type')
         end
@@ -50,10 +60,14 @@ class InfoCommand < HammerCLIForeman::InfoCommand
     end
 
     class CreateCommand < HammerCLIForeman::CreateCommand
+      include CacertFileOption
+
       success_message _('Auth source [%{name}] created.')
       failure_message _('Could not create the Auth Source')
 
-      build_options
+      build_options do |o|
+        o.without(:cacert)
+      end
     end
 
     class DeleteCommand < HammerCLIForeman::DeleteCommand
@@ -64,10 +78,14 @@ class DeleteCommand < HammerCLIForeman::DeleteCommand
     end
 
     class UpdateCommand < HammerCLIForeman::UpdateCommand
+      include CacertFileOption
+
       success_message _('Auth source [%{name}] updated.')
       failure_message _('Could not update the Auth Source')
 
-      build_options
+      build_options do |o|
+        o.without(:cacert)
+      end
     end
 
     autoload_subcommands
diff --git a/test/unit/auth_source_ldap_test.rb b/test/unit/auth_source_ldap_test.rb
index 57658086f..15dcffeb2 100644
--- a/test/unit/auth_source_ldap_test.rb
+++ b/test/unit/auth_source_ldap_test.rb
@@ -60,6 +60,7 @@
 
     describe "parameters" do
       it_should_accept "all required params", ["--name=arch", "--host=my.host"]
+      it_should_accept "cacert file", ["--name=arch", "--host=my.host", "--cacert-file=#{__FILE__}"]
       # it_should_fail_with "name missing", []
       # TODO: temporarily disabled, parameters are checked in the api
     end
@@ -87,6 +88,7 @@
     describe "parameters" do
       it_should_accept "name", ["--name=arch", "--new-name=arch2"]
       it_should_accept "id", ["--id=1", "--new-name=arch2"]
+      it_should_accept "cacert file", ["--id=1", "--cacert-file=#{__FILE__}"]
       # it_should_fail_with "no params", [] # TODO: temporarily disabled, parameters are checked in the id resolver
       # it_should_fail_with "name or id missing", ["--new-name=arch2"] # TODO: temporarily disabled, parameters are checked in the id resolver
     end