diff --git a/cmd/mdmctl/apply.go b/cmd/mdmctl/apply.go
index b1658642..17750623 100644
--- a/cmd/mdmctl/apply.go
+++ b/cmd/mdmctl/apply.go
@@ -10,6 +10,7 @@ import (
 	"strings"
 
 	"github.com/go-kit/kit/log"
+	httptransport "github.com/go-kit/kit/transport/http"
 	"github.com/micromdm/micromdm/core/apply"
 )
 
@@ -25,7 +26,7 @@ func (cmd *applyCommand) setup() error {
 	}
 	cmd.config = cfg
 	logger := log.NewLogfmtLogger(os.Stderr)
-	applysvc, err := apply.NewClient(cfg.ServerURL, logger, cfg.APIToken)
+	applysvc, err := apply.NewClient(cfg.ServerURL, logger, cfg.APIToken, httptransport.SetClient(skipVerifyHTTPClient(cmd.config.SkipVerify)))
 	if err != nil {
 		return err
 	}
diff --git a/cmd/mdmctl/config.go b/cmd/mdmctl/config.go
index c2ec9974..38026642 100644
--- a/cmd/mdmctl/config.go
+++ b/cmd/mdmctl/config.go
@@ -10,12 +10,26 @@ import (
 	"os/user"
 	"path/filepath"
 	"strings"
+
+	"crypto/tls"
+	"net/http"
 )
 
 type configCommand struct {
 	config *ClientConfig
 }
 
+// skipVerifyHTTPClient returns an *http.Client with InsecureSkipVerify set
+// to true for its TLS config. This allows self-signed SSL certificates.
+func skipVerifyHTTPClient(skipVerify bool) *http.Client {
+	if skipVerify {
+		tlsConfig := &tls.Config{InsecureSkipVerify: true}
+		transport := &http.Transport{TLSClientConfig: tlsConfig}
+		return &http.Client{Transport: transport}
+	}
+	return http.DefaultClient
+}
+
 func (cmd *configCommand) Run(args []string) error {
 	if len(args) < 1 {
 		cmd.Usage()
@@ -51,8 +65,9 @@ mdmctl config set -h
 func setCmd(cfg *ClientConfig, args []string) error {
 	flagset := flag.NewFlagSet("set", flag.ExitOnError)
 	var (
-		flToken     = flagset.String("api-token", "", "api token to connect to micromdm server")
-		flServerURL = flagset.String("server-url", "", "server url of micromdm server")
+		flToken      = flagset.String("api-token", "", "api token to connect to micromdm server")
+		flServerURL  = flagset.String("server-url", "", "server url of micromdm server")
+		flSkipVerify = flagset.Bool("skip-verify", false, "skip verification of server certificate (insecure)")
 	)
 
 	flagset.Usage = usageFor(flagset, "mdmctl config set [flags]")
@@ -78,6 +93,8 @@ func setCmd(cfg *ClientConfig, args []string) error {
 		cfg.ServerURL = u.String()
 	}
 
+	cfg.SkipVerify = *flSkipVerify
+
 	return SaveClientConfig(cfg)
 }
 
@@ -131,6 +148,7 @@ func LoadClientConfig() (*ClientConfig, error) {
 }
 
 type ClientConfig struct {
-	APIToken  string `json:"api_token"`
-	ServerURL string `json:"server_url"`
+	APIToken   string `json:"api_token"`
+	ServerURL  string `json:"server_url"`
+	SkipVerify bool   `json:"skip_verify"`
 }
diff --git a/cmd/mdmctl/get.go b/cmd/mdmctl/get.go
index b30f5859..7fb804da 100644
--- a/cmd/mdmctl/get.go
+++ b/cmd/mdmctl/get.go
@@ -13,6 +13,7 @@ import (
 	"encoding/pem"
 
 	"github.com/go-kit/kit/log"
+	httptransport "github.com/go-kit/kit/transport/http"
 	"github.com/micromdm/micromdm/core/list"
 )
 
@@ -28,7 +29,7 @@ func (cmd *getCommand) setup() error {
 	}
 	cmd.config = cfg
 	logger := log.NewLogfmtLogger(os.Stderr)
-	listsvc, err := list.NewClient(cfg.ServerURL, logger, cfg.APIToken)
+	listsvc, err := list.NewClient(cfg.ServerURL, logger, cfg.APIToken, httptransport.SetClient(skipVerifyHTTPClient(cmd.config.SkipVerify)))
 	if err != nil {
 		return err
 	}
diff --git a/core/apply/client.go b/core/apply/client.go
index 92d2e3e2..b3f3783d 100644
--- a/core/apply/client.go
+++ b/core/apply/client.go
@@ -10,7 +10,7 @@ import (
 	httptransport "github.com/go-kit/kit/transport/http"
 )
 
-func NewClient(instance string, logger log.Logger, token string) (Service, error) {
+func NewClient(instance string, logger log.Logger, token string, opts ...httptransport.ClientOption) (Service, error) {
 	u, err := url.Parse(instance)
 	if err != nil {
 		return nil, err
@@ -23,6 +23,7 @@ func NewClient(instance string, logger log.Logger, token string) (Service, error
 			copyURL(u, "/v1/blueprints"),
 			encodeRequestWithToken(token, EncodeHTTPGenericRequest),
 			DecodeBlueprintRequest,
+			opts...,
 		).Endpoint()
 	}
 	var applyDEPTokensEndpoint endpoint.Endpoint
@@ -32,6 +33,7 @@ func NewClient(instance string, logger log.Logger, token string) (Service, error
 			copyURL(u, "/v1/dep-tokens"),
 			encodeRequestWithToken(token, EncodeHTTPGenericRequest),
 			DecodeDEPTokensRequest,
+			opts...,
 		).Endpoint()
 	}
 
diff --git a/core/list/client.go b/core/list/client.go
index 787a636d..c3adb8e5 100644
--- a/core/list/client.go
+++ b/core/list/client.go
@@ -10,7 +10,7 @@ import (
 	httptransport "github.com/go-kit/kit/transport/http"
 )
 
-func NewClient(instance string, logger log.Logger, token string) (Service, error) {
+func NewClient(instance string, logger log.Logger, token string, opts ...httptransport.ClientOption) (Service, error) {
 	u, err := url.Parse(instance)
 	if err != nil {
 		return nil, err
@@ -23,6 +23,7 @@ func NewClient(instance string, logger log.Logger, token string) (Service, error
 			copyURL(u, "/v1/devices"),
 			encodeRequestWithToken(token, EncodeHTTPGenericRequest),
 			DecodeDevicesResponse,
+			opts...,
 		).Endpoint()
 	}
 	var getDEPTokensEndpoint endpoint.Endpoint
@@ -32,6 +33,7 @@ func NewClient(instance string, logger log.Logger, token string) (Service, error
 			copyURL(u, "/v1/dep-tokens"),
 			encodeRequestWithToken(token, EncodeHTTPGenericRequest),
 			DecodeGetDEPTokensResponse,
+			opts...,
 		).Endpoint()
 	}