diff --git a/enroll/service.go b/enroll/service.go
index c23e1ac2..a23a1602 100644
--- a/enroll/service.go
+++ b/enroll/service.go
@@ -131,7 +131,7 @@ func (svc service) Enroll(ctx context.Context) (Profile, error) {
 
 	// Client needs to trust us at this point if we are using a self signed certificate.
 	if len(svc.TLSCert) > 0 {
-		tlsPayload := NewPayload("com.apple.security.pkcs1")
+		tlsPayload := NewPayload("com.apple.security.pem")
 		tlsPayload.PayloadDisplayName = "Self-signed TLS certificate for MicroMDM"
 		tlsPayload.PayloadDescription = "Installs the TLS certificate for MicroMDM"
 		tlsPayload.PayloadIdentifier = "com.github.micromdm.tls"
diff --git a/serve.go b/serve.go
index 8a7d22ca..55930cb2 100644
--- a/serve.go
+++ b/serve.go
@@ -107,6 +107,7 @@ func serve(args []string) error {
 		APNSPrivateKeyPass:  *flAPNSKeyPass,
 		APNSPrivateKeyPath:  *flAPNSKeyPath,
 		depsim:              *flDepSim,
+		tlsCertPath:         *flTLSCert,
 	}
 	if err := os.MkdirAll(configDBPath, 0755); err != nil {
 		return errors.Wrapf(err, "creating config directory %s", configDBPath)
@@ -320,6 +321,7 @@ type config struct {
 	APNSPrivateKeyPath  string
 	APNSCertificatePath string
 	APNSPrivateKeyPass  string
+	tlsCertPath         string
 
 	PushService    *push.Service // bufford push
 	pushService    *nanopush.Push
@@ -488,7 +490,6 @@ func (c *config) setupEnrollmentService() {
 	}
 	SCEPRemoteURL := strings.TrimRight(c.ServerPublicURL, "/") + "/scep"
 
-	var tlsCert string
 	var SCEPCertificateSubject string
 	// TODO: clean up order of inputs. Maybe pass *SCEPConfig as an arg?
 	// but if you do, the packages are coupled, better not.
@@ -498,7 +499,7 @@ func (c *config) setupEnrollmentService() {
 		SCEPRemoteURL,
 		c.SCEPChallenge,
 		c.ServerPublicURL,
-		tlsCert,
+		c.tlsCertPath,
 		SCEPCertificateSubject,
 	)
 }