diff --git a/metropolis/proto/api/configuration.proto b/metropolis/proto/api/configuration.proto
index 62d5094..9ff1c43 100644
--- a/metropolis/proto/api/configuration.proto
+++ b/metropolis/proto/api/configuration.proto
@@ -51,10 +51,11 @@
         // begin registering it into a cluster. It can be retrieved by an
         // operator from a running cluster via Management.GetRegisterTicket.
         bytes register_ticket = 2;
-        // ca_public_key is the public key of the CA of the cluster that the
+        // ca_certificate is the DER-encoded x509 CA of the cluster that the
         // node should expect when contacting nodes in cluster_directory and
-        // attempting to register into a cluster.
-        bytes ca_public_key = 3;
+        // attempting to register into a cluster. It can be retrieved by
+        // an operator from a running cluster via Management.GetClusterInfo.
+        bytes ca_certificate = 3;
     }
     oneof cluster {
         ClusterBootstrap cluster_bootstrap = 1;
diff --git a/metropolis/proto/api/management.proto b/metropolis/proto/api/management.proto
index 9f0e646..44db0c5 100644
--- a/metropolis/proto/api/management.proto
+++ b/metropolis/proto/api/management.proto
@@ -45,6 +45,6 @@
     // cluster that can be used to dial the cluster's services.
     metropolis.proto.common.ClusterDirectory cluster_directory = 1;
 
-    // ca_public_key is the Ed25519 public key of the CA of the cluster.
-    bytes ca_public_key = 2;
+    // ca_certificate is the x509 DER encoded CA certificate of the cluster.
+    bytes ca_certificate = 2;
 }