3 files changed, 41 insertions, 3 deletions

diff --git a/cli/flags.rs b/cli/flags.rs
index bbd23148b..e0b8d807c 100644
--- a/cli/flags.rs
+++ b/cli/flags.rs
@@ -70,6 +70,7 @@ pub enum DenoSubcommand {
     dry_run: bool,
     force: bool,
     version: Option<String>,
+    ca_file: Option<String>,
   },
 }
 
@@ -563,13 +564,17 @@ fn test_parse(flags: &mut Flags, matches: &clap::ArgMatches) {
 }
 
 fn upgrade_parse(flags: &mut Flags, matches: &clap::ArgMatches) {
+  ca_file_arg_parse(flags, matches);
+
   let dry_run = matches.is_present("dry-run");
   let force = matches.is_present("force");
   let version = matches.value_of("version").map(|s| s.to_string());
+  let ca_file = matches.value_of("cert").map(|s| s.to_string());
   flags.subcommand = DenoSubcommand::Upgrade {
     dry_run,
     force,
     version,
+    ca_file,
   };
 }
 
@@ -862,6 +867,7 @@ and is used to replace the current executable.",
         .short("f")
         .help("Replace current exe even if not out-of-date"),
     )
+    .arg(ca_file_arg())
 }
 
 fn doc_subcommand<'a, 'b>() -> App<'a, 'b> {
@@ -1393,7 +1399,8 @@ mod tests {
         subcommand: DenoSubcommand::Upgrade {
           force: true,
           dry_run: true,
-          version: None
+          version: None,
+          ca_file: None
         },
         ..Flags::default()
       }
@@ -2620,6 +2627,25 @@ mod tests {
   }
 
   #[test]
+  fn upgrade_with_ca_file() {
+    let r =
+      flags_from_vec_safe(svec!["deno", "upgrade", "--cert", "example.crt"]);
+    assert_eq!(
+      r.unwrap(),
+      Flags {
+        subcommand: DenoSubcommand::Upgrade {
+          force: false,
+          dry_run: false,
+          version: None,
+          ca_file: Some("example.crt".to_owned()),
+        },
+        ca_file: Some("example.crt".to_owned()),
+        ..Flags::default()
+      }
+    );
+  }
+
+  #[test]
   fn eval_with_inspect() {
     let r = flags_from_vec_safe(svec![
       "deno",
diff --git a/cli/main.rs b/cli/main.rs
index 3f5b9f734..7e61504d0 100644
--- a/cli/main.rs
+++ b/cli/main.rs
@@ -733,7 +733,8 @@ pub fn main() {
       force,
       dry_run,
       version,
-    } => upgrade_command(dry_run, force, version).boxed_local(),
+      ca_file,
+    } => upgrade_command(dry_run, force, version, ca_file).boxed_local(),
     _ => unreachable!(),
   };
 
diff --git a/cli/upgrade.rs b/cli/upgrade.rs
index f840dc4c5..9f3e0459d 100644
--- a/cli/upgrade.rs
+++ b/cli/upgrade.rs
@@ -56,8 +56,19 @@ pub async fn upgrade_command(
   dry_run: bool,
   force: bool,
   version: Option<String>,
+  ca_file: Option<String>,
 ) -> Result<(), ErrBox> {
-  let client = Client::builder().redirect(Policy::none()).build()?;
+  let mut client_builder = Client::builder().redirect(Policy::none());
+
+  // If we have been provided a CA Certificate, add it into the HTTP client
+  if let Some(ca_file) = ca_file {
+    let buf = std::fs::read(ca_file);
+    let cert = reqwest::Certificate::from_pem(&buf.unwrap())?;
+    client_builder = client_builder.add_root_certificate(cert);
+  }
+
+  let client = client_builder.build()?;
+
   let current_version = semver_parse(crate::version::DENO).unwrap();
 
   let install_version = match version {