diff --git a/rootfs/etc/cont-init.d/rclone.sh b/rootfs/etc/cont-init.d/rclone.sh
index 37934e5..9a67d7c 100755
--- a/rootfs/etc/cont-init.d/rclone.sh
+++ b/rootfs/etc/cont-init.d/rclone.sh
@@ -2,6 +2,12 @@
 
 bashio::log.info "Configuring rclone..."
 
+bashio::config.require.username 'credentials.username'
+bashio::config.require.password 'credentials.password'
+
+bashio::config.suggest.true 'tls.ssl'
+bashio::config.require.ssl 'tls' 'tls.certfile' 'tls.keyfile'
+
 sync_command=$(bashio::config 'sync_command')
 destination=$(bashio::config 'destination')
 
diff --git a/rootfs/etc/services.d/web/run b/rootfs/etc/services.d/web/run
index b37b973..924ff2c 100755
--- a/rootfs/etc/services.d/web/run
+++ b/rootfs/etc/services.d/web/run
@@ -2,13 +2,19 @@
 
 bashio::log.info "Starting rclone web..."
 
+# Configure tls
+if bashio::config.true 'tls.ssl'; then
+    ssl_flags=(\
+        "--rc-cert" "/ssl/$(bashio::config 'tls.certfile')" \
+        "--rc-key" "/ssl/$(bashio::config 'tls.keyfile')" \
+    )
+fi
+
 # TODO: Something with UN and PASS
 # Maybe switch to --rc-no-auth and use proxy
 username=$(bashio::config 'credentials.username')
 password=$(bashio::config 'credentials.password')
 
-# TODO: Add cert paths here if ssl is true
-
 exec rclone rcd \
     --rc-web-gui \
     --rc-serve \
@@ -16,4 +22,5 @@ exec rclone rcd \
     --rc-user "$username" \
     --rc-pass "$password" \
     --rc-web-gui-update \
-    --rc-web-gui-no-open-browser
+    --rc-web-gui-no-open-browser \
+    "${ssl_flags[@]}"