diff --git a/conf/weirproxy.yaml b/conf/weirproxy.yaml
index 68469465..6ecee3f3 100644
--- a/conf/weirproxy.yaml
+++ b/conf/weirproxy.yaml
@@ -44,6 +44,7 @@ security:
     # that said, it is both a client and a server object
   client: # server object
     # proxy SQL or internal HTTP port will all use this
+    skip-ca: true
     auto-certs: true
 advance:
   # ignore-wrong-namespace: true
diff --git a/pkg/manager/config/manager.go b/pkg/manager/config/manager.go
index ca270cf9..35023213 100644
--- a/pkg/manager/config/manager.go
+++ b/pkg/manager/config/manager.go
@@ -83,8 +83,6 @@ func (srv *ConfigManager) Init(ctx context.Context, addrs []string, cfg config.A
 	}
 
 	var err error
-	// local connection, let us skip ca check
-	scfg.SkipCA = true
 	etcdConfig.TLS, err = security.BuildClientTLSConfig(logger, scfg, "frontend")
 	if err != nil {
 		return errors.Wrapf(err, "create etcd config center error")