diff --git a/changelog/unreleased/graph-cacert.md b/changelog/unreleased/graph-cacert.md
new file mode 100644
index 00000000000..a8adb211487
--- /dev/null
+++ b/changelog/unreleased/graph-cacert.md
@@ -0,0 +1,6 @@
+Enhancement: Add config option to provide TLS certificate
+
+Added a config option to the graph service to provide a TLS certificate to be used to verify the LDAP server certificate.
+
+https://github.com/owncloud/ocis/issues/3818
+https://github.com/owncloud/ocis/pull/3888
diff --git a/extensions/graph/pkg/config/config.go b/extensions/graph/pkg/config/config.go
index 57c1df58af6..e772929e15d 100644
--- a/extensions/graph/pkg/config/config.go
+++ b/extensions/graph/pkg/config/config.go
@@ -38,6 +38,7 @@ type Spaces struct {
 
 type LDAP struct {
 	URI           string `yaml:"uri" env:"LDAP_URI;GRAPH_LDAP_URI"`
+	CACert        string `yaml:"cacert" env:"LDAP_CACERT;GRAPH_LDAP_CACERT" desc:"The certificate to verify TLS connections"`
 	Insecure      bool   `yaml:"insecure" env:"OCIS_INSECURE;GRAPH_LDAP_INSECURE"`
 	BindDN        string `yaml:"bind_dn" env:"LDAP_BIND_DN;GRAPH_LDAP_BIND_DN"`
 	BindPassword  string `yaml:"bind_password" env:"LDAP_BIND_PASSWORD;GRAPH_LDAP_BIND_PASSWORD"`
diff --git a/extensions/graph/pkg/config/defaults/defaultconfig.go b/extensions/graph/pkg/config/defaults/defaultconfig.go
index e2f2da4b996..581e833eb5b 100644
--- a/extensions/graph/pkg/config/defaults/defaultconfig.go
+++ b/extensions/graph/pkg/config/defaults/defaultconfig.go
@@ -1,9 +1,11 @@
 package defaults
 
 import (
+	"path"
 	"strings"
 
 	"github.com/owncloud/ocis/v2/extensions/graph/pkg/config"
+	"github.com/owncloud/ocis/v2/ocis-pkg/config/defaults"
 )
 
 func FullDefaultConfig() *config.Config {
@@ -41,6 +43,7 @@ func DefaultConfig() *config.Config {
 			LDAP: config.LDAP{
 				URI:                      "ldaps://localhost:9235",
 				Insecure:                 true,
+				CACert:                   path.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
 				BindDN:                   "uid=libregraph,ou=sysusers,o=libregraph-idm",
 				UseServerUUID:            false,
 				WriteEnabled:             true,
diff --git a/extensions/graph/pkg/service/v0/graph_test.go b/extensions/graph/pkg/service/v0/graph_test.go
index 5975ac5d31f..3d81aa5d7a7 100644
--- a/extensions/graph/pkg/service/v0/graph_test.go
+++ b/extensions/graph/pkg/service/v0/graph_test.go
@@ -37,6 +37,7 @@ var _ = Describe("Graph", func() {
 	JustBeforeEach(func() {
 		ctx = context.Background()
 		cfg = defaults.FullDefaultConfig()
+		cfg.Identity.LDAP.CACert = ""
 		cfg.TokenManager.JWTSecret = "loremipsum"
 
 		gatewayClient = &mocks.GatewayClient{}
diff --git a/extensions/graph/pkg/service/v0/service.go b/extensions/graph/pkg/service/v0/service.go
index ca880b1bb62..491b6ffac0b 100644
--- a/extensions/graph/pkg/service/v0/service.go
+++ b/extensions/graph/pkg/service/v0/service.go
@@ -2,6 +2,8 @@ package svc
 
 import (
 	"crypto/tls"
+	"crypto/x509"
+	"io/ioutil"
 	"net/http"
 	"strconv"
 	"time"
@@ -89,6 +91,20 @@ func NewService(opts ...Option) Service {
 				}
 			}
 
+			if options.Config.Identity.LDAP.CACert != "" {
+				if tlsConf == nil {
+					tlsConf = &tls.Config{}
+				}
+				certs := x509.NewCertPool()
+				pemData, err := ioutil.ReadFile(options.Config.Identity.LDAP.CACert)
+				if err != nil {
+					options.Logger.Error().Msgf("Error initializing LDAP Backend: '%s'", err)
+					return nil
+				}
+				certs.AppendCertsFromPEM(pemData)
+				tlsConf.RootCAs = certs
+			}
+
 			conn := ldap.NewLDAPWithReconnect(&options.Logger,
 				ldap.Config{
 					URI:          options.Config.Identity.LDAP.URI,