diff --git a/lib/vagrant/action/builtin/handle_box_url.rb b/lib/vagrant/action/builtin/handle_box_url.rb
index e352ef74b..7235ec4f2 100644
--- a/lib/vagrant/action/builtin/handle_box_url.rb
+++ b/lib/vagrant/action/builtin/handle_box_url.rb
@@ -40,9 +40,12 @@ module Vagrant
 
           box_name = env[:machine].config.vm.box
           box_url  = env[:machine].config.vm.box_url
+          box_download_ca_cert = env[:machine].config.vm.box_download_ca_cert
           box_download_client_cert = env[:machine].config.vm.box_download_client_cert
           box_download_insecure = env[:machine].config.vm.box_download_insecure
 
+          # TODO: expand ca cert path relative to root path
+
           lock.synchronize do
             # Check that we don't already have the box, which can happen
             # if we're slow to acquire the lock because of another thread
@@ -61,6 +64,7 @@ module Vagrant
 
             begin
               env[:action_runner].run(Vagrant::Action.action_box_add, {
+                :box_download_ca_cert => box_download_ca_cert,
                 :box_client_cert => box_download_client_cert,
                 :box_download_insecure => box_download_insecure,
                 :box_name     => box_name,
diff --git a/plugins/kernel_v2/config/vm.rb b/plugins/kernel_v2/config/vm.rb
index bd2a1f60c..d99e8d561 100644
--- a/plugins/kernel_v2/config/vm.rb
+++ b/plugins/kernel_v2/config/vm.rb
@@ -18,6 +18,7 @@ module VagrantPlugins
       attr_accessor :boot_timeout
       attr_accessor :box
       attr_accessor :box_url
+      attr_accessor :box_download_ca_cert
       attr_accessor :box_download_client_cert
       attr_accessor :box_download_insecure
       attr_accessor :graceful_halt_timeout
@@ -28,6 +29,7 @@ module VagrantPlugins
 
       def initialize
         @boot_timeout                 = UNSET_VALUE
+        @box_download_ca_cert         = UNSET_VALUE
         @box_download_client_cert     = UNSET_VALUE
         @box_download_insecure        = UNSET_VALUE
         @box_url                      = UNSET_VALUE
@@ -253,6 +255,7 @@ module VagrantPlugins
       def finalize!
         # Defaults
         @boot_timeout = 300 if @boot_timeout == UNSET_VALUE
+        @box_download_ca_cert = nil if @box_download_ca_cert == UNSET_VALUE
         @box_download_client_cert = nil if @box_download_client_cert == UNSET_VALUE
         @box_download_insecure = false if @box_download_insecure == UNSET_VALUE
         @box_url = nil if @box_url == UNSET_VALUE