diff --git a/src/routes/test/apps-test.js b/src/routes/test/apps-test.js
index f2e46e907..fc9c6b65d 100644
--- a/src/routes/test/apps-test.js
+++ b/src/routes/test/apps-test.js
@@ -156,6 +156,7 @@ function setup(done) {
         },
 
         settings.setDnsConfig.bind(null, { provider: 'route53', accessKeyId: 'accessKeyId', secretAccessKey: 'secretAccessKey', endpoint: 'http://localhost:5353' }),
+        settings.setTlsConfig.bind(null, { provider: 'caas' }),
         settings.setBackupConfig.bind(null, { provider: 'caas', token: 'BACKUP_TOKEN', bucket: 'Bucket', prefix: 'Prefix' })
     ], done);
 }
@@ -1064,6 +1065,8 @@ describe('App installation - port bindings', function () {
 
             settings.setDnsConfig.bind(null, { provider: 'route53', accessKeyId: 'accessKeyId', secretAccessKey: 'secretAccessKey', endpoint: 'http://localhost:5353' }),
 
+            settings.setTlsConfig.bind(null, { provider: 'caas' }),
+
             function (callback) {
                 awsHockInstance
                     .get('/2013-04-01/hostedzone')
diff --git a/src/settings.js b/src/settings.js
index 0c19748ef..c006aef25 100644
--- a/src/settings.js
+++ b/src/settings.js
@@ -27,6 +27,7 @@ exports = module.exports = {
     setBackupConfig: setBackupConfig,
 
     getTlsConfig: getTlsConfig,
+    setTlsConfig: setTlsConfig,
 
     getDefaultSync: getDefaultSync,
     getAll: getAll,
@@ -60,7 +61,7 @@ var gDefaults = (function () {
     result[exports.DEVELOPER_MODE_KEY] = false;
     result[exports.DNS_CONFIG_KEY] = { };
     result[exports.BACKUP_CONFIG_KEY] = { };
-    result[exports.TLS_CONFIG_KEY] = { };
+    result[exports.TLS_CONFIG_KEY] = { provider: 'caas' };
 
     return result;
 })();
@@ -277,6 +278,23 @@ function getTlsConfig(callback) {
     });
 }
 
+function setTlsConfig(tlsConfig, callback) {
+    assert.strictEqual(typeof tlsConfig, 'object');
+    assert.strictEqual(typeof callback, 'function');
+
+    if (tlsConfig.provider !== 'caas' && tlsConfig.provider.indexOf('le-') !== 0) {
+        return callback(new SettingsError(SettingsError.BAD_FIELD, 'provider must be caas or le-*'));
+    }
+
+    settingsdb.set(exports.TLS_CONFIG_KEY, JSON.stringify(tlsConfig), function (error) {
+        if (error) return callback(new SettingsError(SettingsError.INTERNAL_ERROR, error));
+
+        exports.events.emit(exports.TLS_CONFIG_KEY, tlsConfig);
+
+        callback(null);
+    });
+}
+
 function getBackupConfig(callback) {
     assert.strictEqual(typeof callback, 'function');
 
diff --git a/src/test/apptask-test.js b/src/test/apptask-test.js
index 361bc7ce3..163800d9a 100644
--- a/src/test/apptask-test.js
+++ b/src/test/apptask-test.js
@@ -85,7 +85,8 @@ describe('apptask', function () {
         async.series([
             database.initialize,
             appdb.add.bind(null, APP.id, APP.appStoreId, APP.manifest, APP.location, APP.portBindings, APP.accessRestriction, APP.oauthProxy),
-            settings.setDnsConfig.bind(null, { provider: 'route53', accessKeyId: 'accessKeyId', secretAccessKey: 'secretAccessKey', endpoint: 'http://localhost:5353' })
+            settings.setDnsConfig.bind(null, { provider: 'route53', accessKeyId: 'accessKeyId', secretAccessKey: 'secretAccessKey', endpoint: 'http://localhost:5353' }),
+            settings.setTlsConfig.bind(null, { provider: 'caas' })
         ], done);
     });
 
diff --git a/src/test/settings-test.js b/src/test/settings-test.js
index 3f149d2d6..84702b367 100644
--- a/src/test/settings-test.js
+++ b/src/test/settings-test.js
@@ -100,6 +100,21 @@ describe('Settings', function () {
             });
         });
 
+        it('can set tls config', function (done) {
+            settings.setTlsConfig({ provider: 'caas' }, function (error) {
+                expect(error).to.be(null);
+                done();
+            });
+        });
+
+        it('can get tls config', function (done) {
+            settings.getTlsConfig(function (error, dnsConfig) {
+                expect(error).to.be(null);
+                expect(dnsConfig.provider).to.be('caas');
+                done();
+            });
+        });
+
         it('can set backup config', function (done) {
             settings.setBackupConfig({ provider: 'caas', token: 'TOKEN' }, function (error) {
                 expect(error).to.be(null);