diff --git a/ctl/server.go b/ctl/server.go
index e6469ffbd..65f854078 100644
--- a/ctl/server.go
+++ b/ctl/server.go
@@ -63,8 +63,13 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) {
 	flags.StringVar(&srv.Config.Etcd.LPeerURL, "etcd.listen-peer-address", srv.Config.Etcd.LPeerURL, "Listen peer address.")
 	flags.StringVar(&srv.Config.Etcd.APeerURL, "etcd.advertise-peer-address", srv.Config.Etcd.APeerURL, "Advertise peer address. If not provided, uses the listen peer address.")
 	flags.StringVar(&srv.Config.Etcd.ClusterURL, "etcd.cluster-url", srv.Config.Etcd.ClusterURL, "Cluster URL to join.")
-	// Etcd.ClusterName uses Cluster.Name for its value.
 	flags.StringVar(&srv.Config.Etcd.InitCluster, "etcd.initial-cluster", srv.Config.Etcd.InitCluster, "Initial cluster name1=apurl1,name2=apurl2")
+	// Etcd specified tls configuration options
+	flags.StringVar(&srv.Config.Etcd.TrustedCAFile, "etcd.tls-trusted-cafile", srv.Config.Etcd.TrustedCAFile, "Certificate Authority certificate")
+	flags.StringVar(&srv.Config.Etcd.ClientCertFile, "etcd.tls-cert-file", srv.Config.Etcd.ClientCertFile, "Client certificate (required for tls)")
+	flags.StringVar(&srv.Config.Etcd.ClientKeyFile, "etcd.tls-key-file", srv.Config.Etcd.ClientKeyFile, "Client key file (required for tls)")
+	flags.StringVar(&srv.Config.Etcd.PeerCertFile, "etcd.tls-peer-cert-file", srv.Config.Etcd.PeerCertFile, "Peer certificate (required for tls)")
+	flags.StringVar(&srv.Config.Etcd.PeerKeyFile, "etcd.tls-peer-key-file", srv.Config.Etcd.PeerKeyFile, "Peer key file (required for tls)")
 
 	// AntiEntropy
 	flags.DurationVar((*time.Duration)(&srv.Config.AntiEntropy.Interval), "anti-entropy.interval", (time.Duration)(srv.Config.AntiEntropy.Interval), "Interval at which to run anti-entropy routine.")
diff --git a/etcd/embed.go b/etcd/embed.go
index 0092ef42b..09afb7b22 100644
--- a/etcd/embed.go
+++ b/etcd/embed.go
@@ -34,6 +34,7 @@ import (
 	"go.etcd.io/etcd/embed"
 	"go.etcd.io/etcd/etcdserver/api/v3client"
 	"go.etcd.io/etcd/mvcc/mvccpb"
+	"go.etcd.io/etcd/pkg/transport"
 	"go.etcd.io/etcd/pkg/types"
 )
 
@@ -48,6 +49,12 @@ type Options struct {
 	InitCluster  string `toml:"initial-cluster"`
 	ClusterName  string `toml:"cluster-name"`
 	HeartbeatTTL int64  `toml:"heartbeat-ttl"`
+	// TLS provided tls files
+	TrustedCAFile  string `toml:"tls-trusted-cafile"`
+	ClientCertFile string `toml:"tls-cert-file"`
+	ClientKeyFile  string `toml:"tls-key-file"`
+	PeerCertFile   string `toml:"tls-peer-cert-file"`
+	PeerKeyFile    string `toml:"tls-peer-key-file"`
 
 	LPeerSocket   []*net.TCPListener
 	LClientSocket []*net.TCPListener
@@ -171,6 +178,17 @@ func parseOptions(opt Options) *embed.Config {
 		id, name := memberAdd(cli, opt.APeerURL)
 		log.Printf("\tid: %d, name: %s\n", id, name)
 	}
+	// can only use tls if not using pre-configured listeners
+	cfg.ClientTLSInfo = transport.TLSInfo{
+		TrustedCAFile: opt.TrustedCAFile,
+		CertFile:      opt.ClientCertFile,
+		KeyFile:       opt.ClientKeyFile,
+	}
+	cfg.PeerTLSInfo = transport.TLSInfo{
+		TrustedCAFile: opt.TrustedCAFile,
+		CertFile:      opt.PeerCertFile,
+		KeyFile:       opt.PeerKeyFile,
+	}
 
 	return cfg
 }
diff --git a/server/config.go b/server/config.go
index 1c004b7e8..edb69d5ec 100644
--- a/server/config.go
+++ b/server/config.go
@@ -351,6 +351,12 @@ func NewConfig() *Config {
 	c.Etcd.InitCluster = c.Name + "=" + c.Etcd.LPeerURL
 	c.Etcd.HeartbeatTTL = 5
 
+	c.Etcd.TrustedCAFile = ""
+	c.Etcd.ClientCertFile = ""
+	c.Etcd.ClientKeyFile = ""
+	c.Etcd.PeerCertFile = ""
+	c.Etcd.PeerKeyFile = ""
+
 	return c
 }