diff --git a/cmd/frostfs-cli/modules/tree/client.go b/cmd/frostfs-cli/modules/tree/client.go
index 421b96ccd..d71a94b98 100644
--- a/cmd/frostfs-cli/modules/tree/client.go
+++ b/cmd/frostfs-cli/modules/tree/client.go
@@ -2,17 +2,19 @@ package tree
 
 import (
 	"context"
+	"crypto/tls"
 	"fmt"
-	"strings"
 
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/common"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/cmd/frostfs-cli/internal/commonflags"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/network"
 	"git.frostfs.info/TrueCloudLab/frostfs-node/pkg/services/tree"
 	tracing "git.frostfs.info/TrueCloudLab/frostfs-observability/tracing/grpc"
+	"git.frostfs.info/TrueCloudLab/frostfs-sdk-go/api/rpc/client"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials"
 	"google.golang.org/grpc/credentials/insecure"
 )
 
@@ -31,6 +33,16 @@ func _client() (tree.TreeServiceClient, error) {
 		return nil, err
 	}
 
+	host, isTLS, err := client.ParseURI(netAddr.URIAddr())
+	if err != nil {
+		return nil, err
+	}
+
+	creds := insecure.NewCredentials()
+	if isTLS {
+		creds = credentials.NewTLS(&tls.Config{})
+	}
+
 	opts := []grpc.DialOption{
 		grpc.WithChainUnaryInterceptor(
 			tracing.NewUnaryClientInterceptor(),
@@ -40,13 +52,10 @@ func _client() (tree.TreeServiceClient, error) {
 		),
 		grpc.WithDefaultCallOptions(grpc.WaitForReady(true)),
 		grpc.WithDisableServiceConfig(),
+		grpc.WithTransportCredentials(creds),
 	}
 
-	if !strings.HasPrefix(netAddr.URIAddr(), "grpcs:") {
-		opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()))
-	}
-
-	cc, err := grpc.NewClient(netAddr.URIAddr(), opts...)
+	cc, err := grpc.NewClient(host, opts...)
 	return tree.NewTreeServiceClient(cc), err
 }