diff --git a/ctl/server.go b/ctl/server.go
index e6469ffbd..fd5365bc8 100644
--- a/ctl/server.go
+++ b/ctl/server.go
@@ -56,14 +56,14 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) {
 	flags.IntVar(&srv.Config.Translation.MapSize, "translation.map-size", srv.Config.Translation.MapSize, "Size in bytes of mmap to allocate for key translation.")
 
 	// Etcd
-	// Etcd.Name used Config.Name for it's value.
+	// Etcd.Name used Config.Name for its value.
 	// Etcd.Dir defaults to a directory under the pilosa data directory.
+	// Etcd.ClusterName uses Cluster.Name for its value
 	flags.StringVar(&srv.Config.Etcd.LClientURL, "etcd.listen-client-address", srv.Config.Etcd.LClientURL, "Listen client address.")
 	flags.StringVar(&srv.Config.Etcd.AClientURL, "etcd.advertise-client-address", srv.Config.Etcd.AClientURL, "Advertise client address. If not provided, uses the listen client address.")
 	flags.StringVar(&srv.Config.Etcd.LPeerURL, "etcd.listen-peer-address", srv.Config.Etcd.LPeerURL, "Listen peer address.")
 	flags.StringVar(&srv.Config.Etcd.APeerURL, "etcd.advertise-peer-address", srv.Config.Etcd.APeerURL, "Advertise peer address. If not provided, uses the listen peer address.")
 	flags.StringVar(&srv.Config.Etcd.ClusterURL, "etcd.cluster-url", srv.Config.Etcd.ClusterURL, "Cluster URL to join.")
-	// Etcd.ClusterName uses Cluster.Name for its value.
 	flags.StringVar(&srv.Config.Etcd.InitCluster, "etcd.initial-cluster", srv.Config.Etcd.InitCluster, "Initial cluster name1=apurl1,name2=apurl2")
 
 	// AntiEntropy
diff --git a/etcd/embed.go b/etcd/embed.go
index 0092ef42b..09afb7b22 100644
--- a/etcd/embed.go
+++ b/etcd/embed.go
@@ -34,6 +34,7 @@ import (
 	"go.etcd.io/etcd/embed"
 	"go.etcd.io/etcd/etcdserver/api/v3client"
 	"go.etcd.io/etcd/mvcc/mvccpb"
+	"go.etcd.io/etcd/pkg/transport"
 	"go.etcd.io/etcd/pkg/types"
 )
 
@@ -48,6 +49,12 @@ type Options struct {
 	InitCluster  string `toml:"initial-cluster"`
 	ClusterName  string `toml:"cluster-name"`
 	HeartbeatTTL int64  `toml:"heartbeat-ttl"`
+	// TLS provided tls files
+	TrustedCAFile  string `toml:"tls-trusted-cafile"`
+	ClientCertFile string `toml:"tls-cert-file"`
+	ClientKeyFile  string `toml:"tls-key-file"`
+	PeerCertFile   string `toml:"tls-peer-cert-file"`
+	PeerKeyFile    string `toml:"tls-peer-key-file"`
 
 	LPeerSocket   []*net.TCPListener
 	LClientSocket []*net.TCPListener
@@ -171,6 +178,17 @@ func parseOptions(opt Options) *embed.Config {
 		id, name := memberAdd(cli, opt.APeerURL)
 		log.Printf("\tid: %d, name: %s\n", id, name)
 	}
+	// can only use tls if not using pre-configured listeners
+	cfg.ClientTLSInfo = transport.TLSInfo{
+		TrustedCAFile: opt.TrustedCAFile,
+		CertFile:      opt.ClientCertFile,
+		KeyFile:       opt.ClientKeyFile,
+	}
+	cfg.PeerTLSInfo = transport.TLSInfo{
+		TrustedCAFile: opt.TrustedCAFile,
+		CertFile:      opt.PeerCertFile,
+		KeyFile:       opt.PeerKeyFile,
+	}
 
 	return cfg
 }
diff --git a/server/config.go b/server/config.go
index 1c004b7e8..edb69d5ec 100644
--- a/server/config.go
+++ b/server/config.go
@@ -351,6 +351,12 @@ func NewConfig() *Config {
 	c.Etcd.InitCluster = c.Name + "=" + c.Etcd.LPeerURL
 	c.Etcd.HeartbeatTTL = 5
 
+	c.Etcd.TrustedCAFile = ""
+	c.Etcd.ClientCertFile = ""
+	c.Etcd.ClientKeyFile = ""
+	c.Etcd.PeerCertFile = ""
+	c.Etcd.PeerKeyFile = ""
+
 	return c
 }
 
diff --git a/server/server.go b/server/server.go
index 40ff3a7ec..d4b47a6e1 100644
--- a/server/server.go
+++ b/server/server.go
@@ -381,6 +381,12 @@ func (m *Command) SetupServer() error {
 	//
 	// Use name for etcd.name
 	m.Config.Etcd.Name = m.Config.Name
+	// use the pilosa provided tls credentials if available
+	m.Config.Etcd.TrustedCAFile = m.Config.TLS.CACertPath
+	m.Config.Etcd.ClientCertFile = m.Config.TLS.CertificatePath
+	m.Config.Etcd.ClientKeyFile = m.Config.TLS.CertificateKeyPath
+	m.Config.Etcd.PeerCertFile = m.Config.TLS.CertificatePath
+	m.Config.Etcd.PeerKeyFile = m.Config.TLS.CertificateKeyPath
 	//
 	// If an Etcd.Dir is not provided, nest a default under the pilosa data dir.
 	if m.Config.Etcd.Dir == "" {