diff --git a/cinch/roles/jenkins_master/defaults/main.yml b/cinch/roles/jenkins_master/defaults/main.yml
index 52dd2a0..174859c 100644
--- a/cinch/roles/jenkins_master/defaults/main.yml
+++ b/cinch/roles/jenkins_master/defaults/main.yml
@@ -9,7 +9,12 @@
 # A list of Jenkins update center URLs to configure. This is the default UC
 # provided by the upstream, public infrastructure. If you maintain a local
 # mirror for custom plugins or just for mirroring purposes, then override this
-# variable with those values.
+# variable with those values. Local update centers may require a certificate
+# which can be installed with the update_center_certificate variable.  By
+# default, this path is a local path on the system where Ansible is running,
+# but you may set update_center_certificate_remote_src to true to copy the
+# certificate from a path on the remote Jenkins master to the proper
+# destination in JENKINS_HOME.
 update_centers:
   - id: default
     url: "https://updates.jenkins-ci.org/{{ jenkins_uc_version }}/update-center.json"
diff --git a/cinch/roles/jenkins_master/tasks/plugins.yml b/cinch/roles/jenkins_master/tasks/plugins.yml
index 47ca973..9e056c3 100644
--- a/cinch/roles/jenkins_master/tasks/plugins.yml
+++ b/cinch/roles/jenkins_master/tasks/plugins.yml
@@ -21,6 +21,7 @@
   copy:
     src: "{{ update_center_certificate }}"
     dest: "{{ jenkins_home }}/update-center-rootCAs/update-center.crt"
+    remote_src: "{{ update_center_certificate_remote_src | default(false) }}"
     owner: jenkins
     group: jenkins
   notify: restart Jenkins