diff --git a/cmd/derper/derper.go b/cmd/derper/derper.go
index a8b247eb3..e044421a9 100644
--- a/cmd/derper/derper.go
+++ b/cmd/derper/derper.go
@@ -141,7 +141,7 @@ func main() {
 
 	cfg := loadConfig()
 
-	serveTLS := tsweb.IsProd443(*addr)
+	serveTLS := tsweb.IsProd443(*addr) || *certMode == "manual"
 
 	s := derp.NewServer(cfg.PrivateKey, log.Printf)
 	s.SetVerifyClient(*verifyClients)