diff --git a/packages/ctl/ctl.js b/packages/ctl/ctl.js
index 7ca51d56..449ac26f 100755
--- a/packages/ctl/ctl.js
+++ b/packages/ctl/ctl.js
@@ -698,10 +698,15 @@ class ControlConnector extends libLink.WebSocketClientConnector {
  */
 class Control extends libLink.Link {
 
-	constructor(connector, controlPlugins) {
+	constructor(connector, tlsCa, controlPlugins) {
 		super("control", "master", connector);
 		libLink.attachAllMessages(this);
 
+		/**
+		 * Certificate authority used to validate TLS connections to the master.
+		 * @type {?string}
+		 */
+		this.tlsCa = tlsCa;
 		/**
 		 * Mapping of plugin names to their instance for loaded plugins.
 		 * @type {Map<string, module:lib/plugin.BaseControlPlugin>}
@@ -917,7 +922,7 @@ async function startControl() {
 		tlsCa,
 		controlConfig.get("control.master_token")
 	);
-	let control = new Control(controlConnector, controlPlugins);
+	let control = new Control(controlConnector, tlsCa, controlPlugins);
 	try {
 		await controlConnector.connect();
 	} catch (err) {
diff --git a/packages/slave/slave.js b/packages/slave/slave.js
index 5461a2c3..5076d5db 100755
--- a/packages/slave/slave.js
+++ b/packages/slave/slave.js
@@ -736,7 +736,7 @@ class Instance extends libLink.Link {
 			let response = await phin({
 				url, method: "PUT",
 				data: content,
-				core: { rejectUnauthorized: false },
+				core: { ca: this._slave.tlsCa },
 				headers: {
 					"Content-Type": "application/zip",
 					"x-access-token": this._slave.config.get("slave.master_token"),
@@ -976,7 +976,7 @@ function checkFilename(name) {
 class Slave extends libLink.Link {
 	// I don't like God classes, but the alternative of putting all this state
 	// into global variables is not much better.
-	constructor(connector, slaveConfig, pluginInfos) {
+	constructor(connector, slaveConfig, tlsCa, pluginInfos) {
 		super("slave", "master", connector);
 		libLink.attachAllMessages(this);
 
@@ -987,6 +987,12 @@ class Slave extends libLink.Link {
 
 		this.config = slaveConfig;
 
+		/**
+		 * Certificate authority used to validate TLS connections to the master.
+		 * @type {?string}
+		 */
+		this.tlsCa = tlsCa;
+
 		this.instanceConnections = new Map();
 		this.discoveredInstanceInfos = new Map();
 		this.instanceInfos = new Map();
@@ -1618,7 +1624,7 @@ async function startSlave() {
 	}
 
 	let slaveConnector = new SlaveConnector(slaveConfig, tlsCa, pluginInfos);
-	let slave = new Slave(slaveConnector, slaveConfig, pluginInfos);
+	let slave = new Slave(slaveConnector, slaveConfig, tlsCa, pluginInfos);
 
 	// Handle interrupts
 	let secondSigint = false;