diff --git a/config_example.sh b/config_example.sh
index a792dc4f4..55687ad60 100755
--- a/config_example.sh
+++ b/config_example.sh
@@ -188,3 +188,8 @@ set -x
 
 # Image reference for installing hive. See hive_install.sh.
 #export HIVE_DEPLOY_IMAGE="registry.svc.ci.openshift.org/openshift/hive-v4.0:hive"
+
+# PEM-encoded X.509 certificate bundle that will be added to the nodes' trusted 
+# certificate store. This trust bundle may also be used when a proxy has 
+# been configured.
+# export ADDITIONAL_TRUST_BUNDLE=$(cat ca)
diff --git a/ocp_install_env.sh b/ocp_install_env.sh
index 03138fae6..ddc59b035 100644
--- a/ocp_install_env.sh
+++ b/ocp_install_env.sh
@@ -97,6 +97,19 @@ EOF
     fi
 }
 
+function additional_trust_bundle() {
+    if [ ! -z "$ADDITIONAL_TRUST_BUNDLE" ] && [ -z $MIRROR_IMAGES ]; then
+cat <<EOF
+additionalTrustBundle: |
+$(echo ${ADDITIONAL_TRUST_BUNDLE} | awk '{ print " ", $0 }')
+EOF
+    elif [ ! -z "$ADDITIONAL_TRUST_BUNDLE" ] && [ ! -z "$MIRROR_IMAGES" ]; then
+cat <<EOF
+$(echo ${ADDITIONAL_TRUST_BUNDLE} | awk '{ print " ", $0 }')
+EOF
+    fi
+}
+
 function cluster_network() {
   if [[ "${IP_STACK}" == "v4" ]]; then
 cat <<EOF
@@ -191,6 +204,7 @@ $(baremetal_network_configuration)
 $(node_map_to_install_config_hosts $NUM_MASTERS 0 master)
 $(node_map_to_install_config_hosts $NUM_WORKERS $NUM_MASTERS worker)
 $(image_mirror_config)
+$(additional_trust_bundle)
 pullSecret: |
   $(jq -c . $install_config_pull_secret)
 sshKey: |