diff --git a/gp-okta.conf b/gp-okta.conf
index c779b63..ac1b828 100644
--- a/gp-okta.conf
+++ b/gp-okta.conf
@@ -8,8 +8,9 @@ sms.okta = 0
 totp.okta = ABCDEFGHIJKLMNOP
 totp.google = ABCDEFGHIJKLMNOP
 gateway = Manual ny1-gw.example.com
+#cert = path-to-client-cert-as-unencrypted-pem-file.pem
 #openconnect_cmd = sudo openconnect
-openconnect_args =                    # optional arguments to openconnect
+openconnect_args =                    # optional arguments to openconnect, probably you might want to repeat the cert here (if used above) with --certificate=xxx
 execute = 0                           # execute openconnect command
 another_dance = 0                     # second round of authentication required
 bug.nl = 0                            # newline work-around for openconnect
diff --git a/gp-okta.py b/gp-okta.py
index 453beef..e3e22c6 100755
--- a/gp-okta.py
+++ b/gp-okta.py
@@ -446,6 +446,9 @@ def main():
 	conf = load_conf(sys.argv[1])
 	
 	s = requests.Session()
+        if conf.get('cert'):
+                s.cert = conf.get('cert')
+        
 	s.headers['User-Agent'] = 'PAN GlobalProtect'
 	saml_xml = paloalto_prelogin(conf, s)
 	redirect_url = okta_saml(conf, s, saml_xml)