diff --git a/src/auth/auth-settings.c b/src/auth/auth-settings.c
index dc4dce2c3b..83db7b9e9e 100644
--- a/src/auth/auth-settings.c
+++ b/src/auth/auth-settings.c
@@ -267,6 +267,9 @@ static const struct setting_define auth_setting_defines[] = {
 	DEF_NOPREFIX(SET_UINT, first_valid_gid),
 	DEF_NOPREFIX(SET_UINT, last_valid_gid),
 
+	DEF_NOPREFIX(SET_STR, ssl_client_ca_dir),
+	DEF_NOPREFIX(SET_STR, ssl_client_ca_file),
+
 	SETTING_DEFINE_LIST_END
 };
 
@@ -304,6 +307,9 @@ static const struct auth_settings auth_default_settings = {
 	.verbose_passwords = "no",
 	.ssl_require_client_cert = FALSE,
 	.ssl_username_from_cert = FALSE,
+	.ssl_client_ca_dir = "",
+	.ssl_client_ca_file = "",
+
 	.use_winbind = FALSE,
 
 	.worker_max_count = 30,
diff --git a/src/auth/auth-settings.h b/src/auth/auth-settings.h
index 409653fd94..27d9fab70c 100644
--- a/src/auth/auth-settings.h
+++ b/src/auth/auth-settings.h
@@ -76,6 +76,9 @@ struct auth_settings {
 	ARRAY(struct auth_userdb_settings *) userdbs;
 
 	const char *base_dir;
+	const char *ssl_client_ca_dir;
+	const char *ssl_client_ca_file;
+
 	bool verbose_proctitle;
 	unsigned int first_valid_uid;
 	unsigned int last_valid_uid;