diff --git a/lib/vagrant/action/builtin/handle_box_url.rb b/lib/vagrant/action/builtin/handle_box_url.rb
index 7235ec4f2..eed8f307d 100644
--- a/lib/vagrant/action/builtin/handle_box_url.rb
+++ b/lib/vagrant/action/builtin/handle_box_url.rb
@@ -44,7 +44,12 @@ module Vagrant
           box_download_client_cert = env[:machine].config.vm.box_download_client_cert
           box_download_insecure = env[:machine].config.vm.box_download_insecure
 
-          # TODO: expand ca cert path relative to root path
+          # Expand the CA cert file relative to the Vagrantfile path, if
+          # there is one.
+          if box_download_ca_cert
+            box_download_ca_cert = File.expand_path(
+              box_download_ca_cert, env[:machine].env.root_path)
+          end
 
           lock.synchronize do
             # Check that we don't already have the box, which can happen
diff --git a/plugins/kernel_v2/config/vm.rb b/plugins/kernel_v2/config/vm.rb
index d99e8d561..191e7a3d1 100644
--- a/plugins/kernel_v2/config/vm.rb
+++ b/plugins/kernel_v2/config/vm.rb
@@ -375,6 +375,16 @@ module VagrantPlugins
         errors << I18n.t("vagrant.config.vm.hostname_invalid_characters") if \
           @hostname && @hostname !~ /^[a-z0-9][-.a-z0-9]+$/i
 
+        if box_download_ca_cert
+          path = Pathname.new(box_download_ca_cert).
+            expand_path(machine.env.root_path)
+          if !path.file?
+            errors << I18n.t(
+              "vagrant.config.vm.box_download_ca_cert_not_found",
+              path: box_download_ca_cert)
+          end
+        end
+
         has_nfs = false
         used_guest_paths = Set.new
         @__synced_folders.each do |id, options|
diff --git a/templates/locales/en.yml b/templates/locales/en.yml
index 4690b0f66..1c5562094 100644
--- a/templates/locales/en.yml
+++ b/templates/locales/en.yml
@@ -720,6 +720,8 @@ en:
         private_key_missing: "`private_key_path` file must exist: %{path}"
       vm:
         base_mac_invalid: "Base MAC address for eth0/NAT must be set. Contact box maintainer for more information."
+        box_download_ca_cert_not_found: |-
+          "box_download_ca_cert" file not found: %{path}
         box_missing: "A box must be specified."
         box_not_found: "The box '%{name}' could not be found."
         hostname_invalid_characters: |-