diff --git a/exabel_data_sdk/client/api/base_api.py b/exabel_data_sdk/client/api/base_api.py
index 6ec6b16..5695f6c 100644
--- a/exabel_data_sdk/client/api/base_api.py
+++ b/exabel_data_sdk/client/api/base_api.py
@@ -18,5 +18,6 @@ def __init__(self, config: ClientConfig):
             assert config.api_key is not None
             self.metadata.append(("x-api-key", config.api_key))
             self.channel = grpc.secure_channel(
-                config.host + ":" + str(config.port), grpc.ssl_channel_credentials()
+                config.host + ":" + str(config.port),
+                grpc.ssl_channel_credentials(root_certificates=config.root_certificates),
             )
diff --git a/exabel_data_sdk/client/client_config.py b/exabel_data_sdk/client/client_config.py
index 17c8205..4ff1eab 100644
--- a/exabel_data_sdk/client/client_config.py
+++ b/exabel_data_sdk/client/client_config.py
@@ -1,4 +1,5 @@
 import os
+from typing import Optional
 
 
 class DefaultConfig:
@@ -12,6 +13,7 @@ def __init__(self) -> None:
         self.host = os.getenv("EXABEL_HOST", "data.api.exabel.com")
         self.port = int(os.getenv("EXABEL_PORT", "21443"))
         self.timeout = int(os.getenv("EXABEL_TIMEOUT", "30"))
+        self.root_certificates: Optional[str] = None
 
 
 class ClientConfig(DefaultConfig):
@@ -26,16 +28,18 @@ def __init__(
         host: str = None,
         port: int = None,
         timeout: int = None,
+        root_certificates: str = None,
     ):
         """
         Initialize a new client configuration.
 
         Args:
-            api_key:        API key to use.
-            client_name:    Name of this client.
-            host:           Exabel API host.
-            port:           Exabel API port.
-            timeout:        Default timeout in seconds to use for API requests.
+            api_key:            API key to use.
+            client_name:        Name of this client.
+            host:               Exabel API host.
+            port:               Exabel API port.
+            timeout:            Default timeout in seconds to use for API requests.
+            root_certificates:  Additional allowed root certificates for verifying TLS connection.
         """
         super().__init__()
 
@@ -44,6 +48,7 @@ def __init__(
         self.host = host or self.host
         self.port = port or self.port
         self.timeout = timeout or self.timeout
+        self.root_certificates = root_certificates or self.root_certificates
 
         if not self.api_key:
             raise ValueError("No API key given. Use of the Exabel SDK requires an API key.")
diff --git a/exabel_data_sdk/client/exabel_client.py b/exabel_data_sdk/client/exabel_client.py
index c14bedd..1aa1abf 100644
--- a/exabel_data_sdk/client/exabel_client.py
+++ b/exabel_data_sdk/client/exabel_client.py
@@ -17,21 +17,23 @@ def __init__(
         host: str = None,
         port: int = None,
         timeout: int = None,
+        root_certificates: str = None,
     ):
         """
         Initialize a new client.
 
         Args:
-            api_key:        API key to use. If not set, the API key must be set using the
-                            environment variable EXABEL_API_KEY. If set to the value 'NO_KEY',
-                            the client will use an insecure channel, typically used for local
-                            testing.
-            client_name:    Override name of this client. Default name is "Exabel Python SDK".
-            host:           Override default Exabel API host.
-            port:           Override default Exabel API port.
-            timeout:        Override default timeout in seconds to use for API requests.
+            api_key:            API key to use. If not set, the API key must be set using the
+                                environment variable EXABEL_API_KEY. If set to the value 'NO_KEY',
+                                the client will use an insecure channel, typically used for local
+                                testing.
+            client_name:        Override name of this client. Default name is "Exabel Python SDK".
+            host:               Override default Exabel API host.
+            port:               Override default Exabel API port.
+            timeout:            Override default timeout in seconds to use for API requests.
+            root_certificates:  Additional allowed root certificates for verifying TLS connection.
         """
-        config = ClientConfig(api_key, client_name, host, port, timeout)
+        config = ClientConfig(api_key, client_name, host, port, timeout, root_certificates)
 
         self.entity_api = EntityApi(config)
         self.signal_api = SignalApi(config)
diff --git a/setup.py b/setup.py
index d8dca6c..be6eba5 100644
--- a/setup.py
+++ b/setup.py
@@ -5,7 +5,7 @@
 
 setuptools.setup(
     name="exabel-data-sdk",
-    version="0.0.10",
+    version="0.0.11",
     author="Exabel",
     author_email="support@exabel.com",
     description="Python SDK for the Exabel Data API",