diff --git a/README.md b/README.md
index 1db5501..619efd8 100644
--- a/README.md
+++ b/README.md
@@ -116,6 +116,10 @@
         (default "example.com:80")
     -username_password string
         (eg 'username:password') credentials for your server. Leave blank to bypass authentication.
+    -ca_file string
+        Absolute path to your server's Certificate Authority root cert. Downloading all roots currently recommended by the Google Internet Authority is a suitable alternative https://pki.google.com/roots.pem. Leave blank to connect using http rather than https.
+    -full_server_name string
+        Fully qualified domain name. Same name used to sign CN. Only necessary if ca_file is specified and the base URL differs from the server address.
 
 Example Usage:
 
diff --git a/api/api.go b/api/api.go
index 5cca4d8..f4cf08b 100644
--- a/api/api.go
+++ b/api/api.go
@@ -19,6 +19,8 @@
 
 import (
 	"bytes"
+	"crypto/tls"
+	"crypto/x509"
 	"encoding/base64"
 	"errors"
 	"fmt"
@@ -56,24 +58,48 @@
 	baseURL     string
 }
 
+func setupCertConfig(caFile string, fullServerName string) (*tls.Config, error) {
+	if caFile == "" {
+		return nil, nil
+	}
+	b, err := ioutil.ReadFile(caFile)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read root certificates file: %v", err)
+	}
+	cp := x509.NewCertPool()
+	if !cp.AppendCertsFromPEM(b) {
+		return nil, errors.New("failed to parse root certificates, please check your roots file (ca_file flag) and try again")
+	}
+	return &tls.Config{
+		RootCAs:    cp,
+		ServerName: fullServerName,
+	}, nil
+}
+
 // InitHTTPConnection creates and returns a new HTTPConnection object
 // with a given server address and username/password.
-func InitHTTPConnection(serverAddr string, credentialsFile string) (*HTTPConnection, error) {
-	usernamePassword := ""
-	if credentialsFile != "" {
-		// Set up username/password.
-		data, err := ioutil.ReadFile(credentialsFile)
-		if err != nil {
-			return nil, err
-		}
-		usernamePassword = strings.Replace(string(data), "\n", "", -1)
+func InitHTTPConnection(serverAddr string, credentialsFile string, caFile string, fullServerName string) (*HTTPConnection, error) {
+	// Set up username/password.
+	data, err := ioutil.ReadFile(credentialsFile)
+	if err != nil {
+		return nil, err
+	}
+	usernamePassword := strings.Replace(string(data), "\n", "", -1)
+	config, err := setupCertConfig(caFile, fullServerName)
+	if err != nil {
+		return nil, err
+	}
+	protocol := "http"
+	if config != nil {
+		protocol = "https"
 	}
 	return &HTTPConnection{
-		client:      &http.Client{Timeout: time.Duration(1 * time.Second)},
+		client: &http.Client{
+			Transport: &http.Transport{TLSClientConfig: config},
+		},
 		credentials: "Basic " + base64.StdEncoding.EncodeToString([]byte(usernamePassword)),
 		marshaler:   &jsonpb.Marshaler{OrigName: true},
-		// TODO(wsilberm): Use https
-		baseURL: "http://" + serverAddr,
+		baseURL:     protocol + "://" + serverAddr,
 	}, nil
 }
 
@@ -105,7 +131,7 @@
 	defer utils.LogFlow("Health Check", "End")
 
 	// See if we get a response.
-	_, err := http.Get(conn.getURL(""))
+	_, err := conn.client.Get(conn.getURL(""))
 	if err != nil {
 		return fmt.Errorf("could not complete health check: %v", err)
 	}
diff --git a/testclient/main.go b/testclient/main.go
index b7610e2..c85de5f 100644
--- a/testclient/main.go
+++ b/testclient/main.go
@@ -34,7 +34,7 @@
 
 var (
 	serverAddr        = flag.String("server_addr", "example.com:80", "Your http server's address in the format of host:port")
-	credentialsFile   = flag.String("credentials_file", "", "File containing credentials for your server. Leave blank to bypass authentication.")
+	credentialsFile   = flag.String("credentials_file", "", "File containing credentials for your server. Leave blank to bypass authentication. File should have exactly one line of the form 'username:password'.")
 	testSlots         = flag.Int("num_test_slots", 10, "Maximum number of slots to test from availability_feed. Slots will be selected randomly")
 	allFlows          = flag.Bool("all_tests", false, "Whether to test all endpoints.")
 	healthFlow        = flag.Bool("health_check_test", false, "Whether to test the Health endpoint.")
@@ -46,6 +46,8 @@
 	cancelAllBookings = flag.Bool("cancel_all_bookings", false, "This option assumes that the ListBookings and UpdateBooking endpoints are fully functional. This is a convenience flag for purging your system of all previously created bookings.")
 	availabilityFeed  = flag.String("availability_feed", "", "Absolute path to availability feed required for all tests except health. Feeds can be in either json or pb3 format")
 	outputDir         = flag.String("output_dir", "", "Absolute path of dir to dump log file.")
+	caFile            = flag.String("ca_file", "", "Absolute path to your server's Certificate Authority root cert. Downloading all roots currently recommended by the Google Internet Authority is a suitable alternative https://pki.google.com/roots.pem. Leave blank to connect using http rather than https.")
+	fullServerName    = flag.String("full_server_name", "", "Fully qualified domain name. Same name used to sign CN. Only necessary if ca_file is specified and the base URL differs from the server address.")
 )
 
 type counters struct {
@@ -171,7 +173,7 @@
 	defer f.Close()
 	log.SetOutput(f)
 
-	conn, err := api.InitHTTPConnection(*serverAddr, *credentialsFile)
+	conn, err := api.InitHTTPConnection(*serverAddr, *credentialsFile, *caFile, *fullServerName)
 	if err != nil {
 		log.Fatalf("Failed to init http connection %v", err)
 	}