diff --git a/tunnelrpc/pogs/tunnelrpc.go b/tunnelrpc/pogs/tunnelrpc.go
index baeaf702..6b8f01a7 100644
--- a/tunnelrpc/pogs/tunnelrpc.go
+++ b/tunnelrpc/pogs/tunnelrpc.go
@@ -32,7 +32,7 @@ type TunnelRegistration struct {
 	LogLines         []string
 	PermanentFailure bool
 	TunnelID         string `capnp:"tunnelID"`
-	OriginCert       string `capnp:"originCert"`
+	OriginCert       []byte `capnp:"originCert"`
 }
 
 func MarshalTunnelRegistration(s tunnelrpc.TunnelRegistration, p *TunnelRegistration) error {
diff --git a/tunnelrpc/tunnelrpc.capnp b/tunnelrpc/tunnelrpc.capnp
index 2686afe2..ef8430f7 100644
--- a/tunnelrpc/tunnelrpc.capnp
+++ b/tunnelrpc/tunnelrpc.capnp
@@ -20,7 +20,7 @@ struct TunnelRegistration {
     # Displayed to user
     tunnelID @4 :Text;
     # Certificate that authorizes the origin to run tunnels on the given url.
-    originCert @5 :Text;
+    originCert @5 :Data;
 }
 
 struct RegistrationOptions {