diff --git a/ESPNTPServer/ESPNTPServer.cpp b/ESPNTPServer/ESPNTPServer.cpp
index 2620e3e..c9f2d1f 100644
--- a/ESPNTPServer/ESPNTPServer.cpp
+++ b/ESPNTPServer/ESPNTPServer.cpp
@@ -71,16 +71,33 @@ void processOTA(const char* ota_url, const char* ota_fp)
 
 	ESPhttpUpdate.rebootOnUpdate(false);
 
-	t_httpUpdate_return ret;
+#ifdef USE_CERT_STORE
+    CertStore certStore;
+#endif
+    WiFiClient *client = nullptr;
 
-	if (strncmp(ota_url, "https:", 6) == 0)
-	{
-		ret = ESPhttpUpdate.update(ota_url, "0.4", ota_fp);
-	}
-	else
-	{
-		ret = ESPhttpUpdate.update(ota_url, "0.4");
-	}
+    if (strncmp(ota_url, "https:", 6) == 0)
+    {
+#ifdef USE_CERT_STORE
+        int numCerts = certStore.initCertStore(SPIFFS, PSTR("/certs.idx"), PSTR("/certs.ar"));
+        dlog.info(FPSTR(TAG), F("Number of CA certs read: %d"), numCerts);
+#endif
+        BearSSL::WiFiClientSecure *bear  = new BearSSL::WiFiClientSecure();
+#ifdef USE_CERT_STORE
+        // Integrate the cert store with this connection
+        dlog.info(FPSTR(TAG), F("adding cert store to connection"));
+        bear->setCertStore(&certStore);
+#else
+        bear->setInsecure();
+#endif
+        client = bear;
+    }
+    else
+    {
+        client = new WiFiClient;
+    }
+
+    t_httpUpdate_return ret = ESPhttpUpdate.update(*client, ota_url, "0.4");
 
 	String reason = ESPhttpUpdate.getLastErrorString();
 
diff --git a/platformio.ini b/platformio.ini
index 77c5a94..015551a 100644
--- a/platformio.ini
+++ b/platformio.ini
@@ -34,6 +34,7 @@ monitor_speed = 76800
 platform = espressif8266@2.2.2
 
 [env:staging]
+build_flags = ${env.build_flags} -DUSE_CERT_STORE
 platform = https://github.com/platformio/platform-espressif8266.git#feature/stage
 platform_packages =
   ; use upstream Git version