diff --git a/Clckwrks/GetOpts.hs b/Clckwrks/GetOpts.hs
--- a/Clckwrks/GetOpts.hs
+++ b/Clckwrks/GetOpts.hs
@@ -31,6 +31,7 @@
     , Option [] ["https-port"]    (ReqArg setTLSPort "port")      ("Port to bind https server, default:" ++ maybe "disabled." show (clckTLSPort <$> (clckTLS def)))
     , Option [] ["tls-cert"]      (ReqArg setTLSCert "path")      ("Path to tls .cert file. (required for https).")
     , Option [] ["tls-key"]       (ReqArg setTLSKey "path")       ("Path to tls .key file. (required for https).")
+    , Option [] ["tls-ca"]        (ReqArg setTLSCA "path")       ("Path to tls .pem file. (required for some certs).")
     , Option [] ["hide-port"]     (NoArg setHidePort)             "Do not show the port number in the URL"
     , Option [] ["hostname"]      (ReqArg setHostname "hostname") ("Server hostename, default: " ++ show (clckHostname def))
     , Option [] ["jquery-path"]   (ReqArg setJQueryPath   "path") ("path to jquery directory, default: " ++ show (clckJQueryPath def))
@@ -44,6 +45,7 @@
       nullTLSSettings     = TLSSettings { clckTLSPort = 443
                                         , clckTLSCert = ""
                                         , clckTLSKey  = ""
+                                        , clckTLSCA   = Nothing
                                         }
       modifyTLS f cc =
           Just $ case clckTLS cc of
@@ -54,6 +56,7 @@
       setTLSPort      str = ModifyConfig $ \c -> c { clckTLS          = modifyTLS (\tls -> tls { clckTLSPort = read str }) c }
       setTLSCert      str = ModifyConfig $ \c -> c { clckTLS          = modifyTLS (\tls -> tls { clckTLSCert = str }) c }
       setTLSKey       str = ModifyConfig $ \c -> c { clckTLS          = modifyTLS (\tls -> tls { clckTLSKey = str }) c }
+      setTLSCA        str = ModifyConfig $ \c -> c { clckTLS          = modifyTLS (\tls -> tls { clckTLSCA = Just str }) c }
       setHostname     str = ModifyConfig $ \c -> c { clckHostname     = str      }
       setHidePort         = ModifyConfig $ \c -> c { clckHidePort     = True     }
       setJQueryPath   str = ModifyConfig $ \c -> c { clckJQueryPath   = str      }
diff --git a/Clckwrks/Monad.hs b/Clckwrks/Monad.hs
--- a/Clckwrks/Monad.hs
+++ b/Clckwrks/Monad.hs
@@ -168,6 +168,7 @@
     { clckTLSPort :: Int
     , clckTLSCert :: FilePath
     , clckTLSKey  :: FilePath
+    , clckTLSCA   :: Maybe FilePath
     }
 
 data ClckwrksConfig = ClckwrksConfig
diff --git a/Clckwrks/Server.hs b/Clckwrks/Server.hs
--- a/Clckwrks/Server.hs
+++ b/Clckwrks/Server.hs
@@ -65,6 +65,7 @@
                    do let tlsConf = nullTLSConf { tlsPort = clckTLSPort
                                                 , tlsCert = clckTLSCert
                                                 , tlsKey  = clckTLSKey
+                                                , tlsCA   = clckTLSCA
                                                 }
                       tid <- forkIO $ simpleHTTPS tlsConf (handlers cc' clckState'')
                       return (Just tid)
diff --git a/clckwrks.cabal b/clckwrks.cabal
--- a/clckwrks.cabal
+++ b/clckwrks.cabal
@@ -1,5 +1,5 @@
 Name:                clckwrks
-Version:             0.20.1
+Version:             0.20.2
 Synopsis:            A secure, reliable content management system (CMS) and blogging platform
 Description:         clckwrks (pronounced, clockworks) aims to compete
                      directly with popular PHP-based blogging and CMS
@@ -76,7 +76,7 @@
      happstack-authenticate       == 0.10.*,
      happstack-hsp                == 7.2.*,
      happstack-server             >= 7.0 && < 7.4,
-     happstack-server-tls         >= 7.0 && < 7.2,
+     happstack-server-tls         >= 7.1 && < 7.2,
      hsp                          >= 0.9 && < 0.11,
      hsx-jmacro                   == 7.3.*,
      ixset                        == 1.0.*,