diff --git a/src/tuimble/client.py b/src/tuimble/client.py
index 04bb184..48b9b08 100644
--- a/src/tuimble/client.py
+++ b/src/tuimble/client.py
@@ -48,11 +48,15 @@ class MumbleClient:
         port: int = 64738,
         username: str = "tuimble-user",
         password: str = "",
+        certfile: str = "",
+        keyfile: str = "",
     ):
         self._host = host
         self._port = port
         self._username = username
         self._password = password
+        self._certfile = certfile
+        self._keyfile = keyfile
         self._mumble = None
         self._connected = False
         self._dispatcher: Callable | None = None
@@ -137,12 +141,19 @@ class MumbleClient:
         """Connect to the Mumble server (blocking)."""
         import pymumble_py3 as pymumble
 
+        kwargs = {
+            "port": self._port,
+            "password": self._password,
+            "reconnect": False,
+        }
+        if self._certfile:
+            kwargs["certfile"] = self._certfile
+        if self._keyfile:
+            kwargs["keyfile"] = self._keyfile
         self._mumble = pymumble.Mumble(
             self._host,
             self._username,
-            port=self._port,
-            password=self._password,
-            reconnect=False,
+            **kwargs,
         )
         self._mumble.set_codec_profile("audio")
         self._mumble.set_receive_sound(True)
diff --git a/tests/test_client.py b/tests/test_client.py
index a998d23..020c58d 100644
--- a/tests/test_client.py
+++ b/tests/test_client.py
@@ -67,3 +67,19 @@ def test_set_self_deaf_noop_when_disconnected():
     client = MumbleClient(host="localhost")
     # Should not raise when not connected
     client.set_self_deaf(True)
+
+
+def test_cert_defaults():
+    client = MumbleClient(host="localhost")
+    assert client._certfile == ""
+    assert client._keyfile == ""
+
+
+def test_cert_custom():
+    client = MumbleClient(
+        host="localhost",
+        certfile="/path/cert.pem",
+        keyfile="/path/key.pem",
+    )
+    assert client._certfile == "/path/cert.pem"
+    assert client._keyfile == "/path/key.pem"