diff --git a/README.md b/README.md
index 5cea7fc..e608b3b 100644
--- a/README.md
+++ b/README.md
@@ -68,6 +68,9 @@ Options:
   -W, --without-data              Do not transfer table data, DDL only.
   -h, --mysql-host TEXT           MySQL host. Defaults to localhost.
   -P, --mysql-port INTEGER        MySQL port. Defaults to 3306.
+  --mysql-ssl-cert PATH           Path to SSL certificate file.
+  --mysql-ssl-key PATH            Path to SSL key file.
+  --mysql-ssl-ca PATH             Path to SSL CA certificate file.
   -S, --skip-ssl                  Disable MySQL connection encryption.
   -c, --chunk INTEGER             Chunk reading/writing SQL records
   -l, --log-file PATH             Log file
diff --git a/docs/README.rst b/docs/README.rst
index d2ae289..0864fda 100644
--- a/docs/README.rst
+++ b/docs/README.rst
@@ -43,6 +43,9 @@ Connection Options
 
 - ``-h, --mysql-host TEXT``: MySQL host. Defaults to localhost.
 - ``-P, --mysql-port INTEGER``: MySQL port. Defaults to 3306.
+- ``--mysql-ssl-cert PATH``: Path to SSL certificate file.
+- ``--mysql-ssl-key PATH``: Path to SSL key file.
+- ``--mysql-ssl-ca PATH``: Path to SSL CA certificate file.
 - ``-S, --skip-ssl``: Disable MySQL connection encryption.
 
 Other Options
diff --git a/src/mysql_to_sqlite3/cli.py b/src/mysql_to_sqlite3/cli.py
index 4a78c55..29daec7 100644
--- a/src/mysql_to_sqlite3/cli.py
+++ b/src/mysql_to_sqlite3/cli.py
@@ -100,6 +100,9 @@
 )
 @click.option("-h", "--mysql-host", default="localhost", help="MySQL host. Defaults to localhost.")
 @click.option("-P", "--mysql-port", type=int, default=3306, help="MySQL port. Defaults to 3306.")
+@click.option("--mysql-ssl-cert", type=click.Path(), help="Path to SSL certificate file.")
+@click.option("--mysql-ssl-key", type=click.Path(), help="Path to SSL key file.")
+@click.option("--mysql-ssl-ca", type=click.Path(), help="Path to SSL CA certificate file.")
 @click.option("-S", "--skip-ssl", is_flag=True, help="Disable MySQL connection encryption.")
 @click.option(
     "-c",
@@ -142,6 +145,9 @@ def cli(
     without_data: bool,
     mysql_host: str,
     mysql_port: int,
+    mysql_ssl_cert: t.Optional[str],
+    mysql_ssl_key: t.Optional[str],
+    mysql_ssl_ca: t.Optional[str],
     skip_ssl: bool,
     chunk: int,
     log_file: t.Union[str, "os.PathLike[t.Any]"],
@@ -171,6 +177,9 @@ def cli(
             without_data=without_data,
             mysql_host=mysql_host,
             mysql_port=mysql_port,
+            mysql_ssl_cert=mysql_ssl_cert,
+            mysql_ssl_key=mysql_ssl_key,
+            mysql_ssl_ca=mysql_ssl_ca,
             mysql_ssl_disabled=skip_ssl,
             chunk=chunk,
             json_as_text=json_as_text,
diff --git a/src/mysql_to_sqlite3/transporter.py b/src/mysql_to_sqlite3/transporter.py
index 171b17c..9420226 100644
--- a/src/mysql_to_sqlite3/transporter.py
+++ b/src/mysql_to_sqlite3/transporter.py
@@ -88,6 +88,12 @@ def __init__(self, **kwargs: tx.Unpack[MySQLtoSQLiteParams]) -> None:
 
         self._without_data = kwargs.get("without_data") or False
 
+        self._mysql_ssl_ca = kwargs.get("mysql_ssl_ca") or None
+
+        self._mysql_ssl_cert = kwargs.get("mysql_ssl_cert") or None
+
+        self._mysql_ssl_key = kwargs.get("mysql_ssl_key") or None
+
         self._mysql_ssl_disabled = kwargs.get("mysql_ssl_disabled") or False
 
         self._current_chunk_number = 0
@@ -123,6 +129,9 @@ def __init__(self, **kwargs: tx.Unpack[MySQLtoSQLiteParams]) -> None:
                 password=self._mysql_password,
                 host=self._mysql_host,
                 port=self._mysql_port,
+                ssl_ca=self._mysql_ssl_ca,
+                ssl_cert=self._mysql_ssl_cert,
+                ssl_key=self._mysql_ssl_key,
                 ssl_disabled=self._mysql_ssl_disabled,
             )
             if isinstance(_mysql_connection, MySQLConnectionAbstract):