diff --git a/cfg/config.go b/cfg/config.go
index c39e23429..ad3122138 100644
--- a/cfg/config.go
+++ b/cfg/config.go
@@ -64,6 +64,13 @@ type PipelineConfig struct {
 	Raw *simplejson.Json
 }
 
+type VaultTLSConfig struct {
+	CACert     string
+	ClientCert string
+	ClientKey  string
+	Insecure   bool
+}
+
 type VaultConfig struct {
 	Address string
 
@@ -72,6 +79,8 @@ type VaultConfig struct {
 	AuthMountPath string
 	RoleID        string
 	SecretID      string
+
+	TLS *VaultTLSConfig
 }
 
 func NewConfig() *Config {
@@ -203,9 +212,26 @@ func parseVaultConfig(vault *simplejson.Json) (*VaultConfig, error) {
 		SecretID:      vault.Get("secret_id").MustString(),
 	}
 
+	tls := vault.Get("tls")
+	if tls.Interface() != nil {
+		vc.TLS = &VaultTLSConfig{
+			CACert:     tls.Get("ca_cert").MustString(),
+			ClientCert: tls.Get("client_cert").MustString(),
+			ClientKey:  tls.Get("client_key").MustString(),
+			Insecure:   tls.Get("insecure").MustBool(),
+		}
+	}
+
 	if vc.Address == "" {
-		return nil, errors.New("vault address must be non-empty string")
+		return nil, errors.New("vault address must be provided")
+	}
+	if vc.TLS != nil {
+		if vc.TLS.ClientCert != "" && vc.TLS.ClientKey == "" ||
+			vc.TLS.ClientCert == "" && vc.TLS.ClientKey != "" {
+			return nil, errors.New("both client cert and client key must be provided")
+		}
 	}
+
 	if vc.Token != "" {
 		return vc, nil
 	}
diff --git a/cfg/vault.go b/cfg/vault.go
index 624d8fcaf..10a781be3 100644
--- a/cfg/vault.go
+++ b/cfg/vault.go
@@ -3,11 +3,13 @@ package cfg
 import (
 	"context"
 	"fmt"
+	"net/http"
 	"strings"
 
 	"github.com/hashicorp/vault/api"
 	auth "github.com/hashicorp/vault/api/auth/approle"
 	"github.com/ozontech/file.d/logger"
+	"github.com/ozontech/file.d/xtls"
 )
 
 type secreter interface {
@@ -25,6 +27,24 @@ func newVault(cfg *VaultConfig) (*vault, error) {
 
 	conf := api.DefaultConfig()
 	conf.Address = cfg.Address
+	if tls := cfg.TLS; tls != nil {
+		b := xtls.NewConfigBuilder()
+		if tls.CACert != "" {
+			if err := b.AppendCARoot(tls.CACert); err != nil {
+				return nil, fmt.Errorf("can't append CA root: %w", err)
+			}
+		}
+		if tls.ClientCert != "" && tls.ClientKey != "" {
+			if err := b.AppendX509KeyPair(tls.ClientCert, tls.ClientKey); err != nil {
+				return nil, fmt.Errorf("can't append X509 key pair: %w", err)
+			}
+		}
+		b.SetSkipVerify(tls.Insecure)
+
+		transport, _ := conf.HttpClient.Transport.(*http.Transport)
+		transport.TLSClientConfig = b.Build()
+	}
+
 	c, err := api.NewClient(conf)
 	if err != nil {
 		return nil, fmt.Errorf("can't create api client: %w", err)
diff --git a/docs/configuring.idoc.md b/docs/configuring.idoc.md
index 21910691f..eb909c5dc 100644
--- a/docs/configuring.idoc.md
+++ b/docs/configuring.idoc.md
@@ -137,9 +137,18 @@ vault:
   auth_mount_path: some/path # used when formatting the authorization uri: 'auth/%s/login'
 ```
 
+### TLS support
+```yaml
+vault:
+  tls:
+    ca_cert: path_or_content_of_ca_cert_file
+    client_cert: path_or_content_of_client_cert_file
+    client_key: path_or_content_of_client_key_file
+    insecure: true
+```
+
 ## Env support
 Consider this config:
-
 ```yaml
 pipelines:
   example:
diff --git a/docs/configuring.md b/docs/configuring.md
index e0928a7ef..f69e9c9b3 100644
--- a/docs/configuring.md
+++ b/docs/configuring.md
@@ -137,9 +137,18 @@ vault:
   auth_mount_path: some/path # used when formatting the authorization uri: 'auth/%s/login'
 ```
 
+### TLS support
+```yaml
+vault:
+  tls:
+    ca_cert: path_or_content_of_ca_cert_file
+    client_cert: path_or_content_of_client_cert_file
+    client_key: path_or_content_of_client_key_file
+    insecure: true
+```
+
 ## Env support
 Consider this config:
-
 ```yaml
 pipelines:
   example: