diff --git a/config-sample.ini b/config-sample.ini
index bf642a0e9..c706efea0 100644
--- a/config-sample.ini
+++ b/config-sample.ini
@@ -9,4 +9,5 @@ keyPath=
 [Sync]
 syncServerHost=
 syncServerTimeout=10000
-syncProxy=
\ No newline at end of file
+syncProxy=
+syncServerCertificate=
\ No newline at end of file
diff --git a/generate-cert.sh b/generate-cert.sh
index 1610d82a6..770bddbf0 100644
--- a/generate-cert.sh
+++ b/generate-cert.sh
@@ -1,3 +1,16 @@
 #!/bin/bash
+# Script generates certificate by default into the ~/trilium-data/cert where it is expected by Trilium
+# If directory is given in argument, certificate will be created there.
+
+if [ $# -eq 0 ]
+  then
+    DIR=~/trilium-data/cert
+else
+    DIR=$1
+fi
+
+mkdir -p "$DIR"
+cd "$DIR"
 
 openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 2000 -nodes
+
diff --git a/services/sync.js b/services/sync.js
index 43686c69f..cd1fb0a7c 100644
--- a/services/sync.js
+++ b/services/sync.js
@@ -12,6 +12,7 @@ const notes = require('./notes');
 const syncUpdate = require('./sync_update');
 const content_hash = require('./content_hash');
 const event_log = require('./event_log');
+const fs = require('fs');
 
 const SYNC_SERVER = config['Sync']['syncServerHost'];
 const isSyncSetup = !!SYNC_SERVER;
@@ -20,6 +21,7 @@ const SYNC_PROXY = config['Sync']['syncProxy'];
 
 let syncInProgress = false;
 let proxyToggle = true;
+let syncServerCertificate = null;
 
 async function sync() {
     if (syncInProgress) {
@@ -288,6 +290,10 @@ async function syncRequest(syncContext, method, uri, body) {
             timeout: SYNC_TIMEOUT
         };
 
+        if (syncServerCertificate) {
+            options.ca = syncServerCertificate;
+        }
+
         if (SYNC_PROXY && proxyToggle) {
             options.proxy = SYNC_PROXY;
         }
@@ -306,6 +312,14 @@ if (isSyncSetup) {
         log.info("Sync proxy: " + SYNC_PROXY);
     }
 
+    const syncCertPath = config['Sync']['syncServerCertificate'];
+
+    if (syncCertPath) {
+        log.info('Sync certificate: ' + syncCertPath);
+
+        syncServerCertificate = fs.readFileSync(syncCertPath);
+    }
+
     setInterval(sync, 60000);
 
     // kickoff initial sync immediately