diff --git a/plugin/tls/README.md b/plugin/tls/README.md
index 305c7772e..8a985cec7 100644
--- a/plugin/tls/README.md
+++ b/plugin/tls/README.md
@@ -22,9 +22,11 @@ wire data of a DNS message.
 ## Syntax
 
 ~~~ txt
-tls CERT KEY CA
+tls CERT KEY [CA]
 ~~~
 
+Parameter CA is optional. If not set, system CAs can be used to verify the client certificate
+
 ## Examples
 
 Start a DNS-over-TLS server that picks up incoming DNS-over-TLS queries on port 5553 and uses the
diff --git a/plugin/tls/tls.go b/plugin/tls/tls.go
index e0958a9aa..e08e522ab 100644
--- a/plugin/tls/tls.go
+++ b/plugin/tls/tls.go
@@ -24,10 +24,10 @@ func setup(c *caddy.Controller) error {
 
 	for c.Next() {
 		args := c.RemainingArgs()
-		if len(args) != 3 {
+		if len(args) < 2 || len(args) > 3 {
 			return plugin.Error("tls", c.ArgErr())
 		}
-		tls, err := tls.NewTLSConfig(args[0], args[1], args[2])
+		tls, err := tls.NewTLSConfigFromArgs(args...)
 		if err != nil {
 			return plugin.Error("tls", err)
 		}