diff --git a/tunnelrpc/pogs/tunnelrpc.go b/tunnelrpc/pogs/tunnelrpc.go
index b33709dd..baeaf702 100644
--- a/tunnelrpc/pogs/tunnelrpc.go
+++ b/tunnelrpc/pogs/tunnelrpc.go
@@ -32,6 +32,7 @@ type TunnelRegistration struct {
 	LogLines         []string
 	PermanentFailure bool
 	TunnelID         string `capnp:"tunnelID"`
+	OriginCert       string `capnp:"originCert"`
 }
 
 func MarshalTunnelRegistration(s tunnelrpc.TunnelRegistration, p *TunnelRegistration) error {
diff --git a/tunnelrpc/tunnelrpc.capnp b/tunnelrpc/tunnelrpc.capnp
index 25e4de54..2686afe2 100644
--- a/tunnelrpc/tunnelrpc.capnp
+++ b/tunnelrpc/tunnelrpc.capnp
@@ -19,6 +19,8 @@ struct TunnelRegistration {
     permanentFailure @3 :Bool;
     # Displayed to user
     tunnelID @4 :Text;
+    # Certificate that authorizes the origin to run tunnels on the given url.
+    originCert @5 :Text;
 }
 
 struct RegistrationOptions {