diff --git a/internal/certauthority/certauthority.go b/internal/certauthority/certauthority.go
index 6d3cff84c..87bdd7845 100644
--- a/internal/certauthority/certauthority.go
+++ b/internal/certauthority/certauthority.go
@@ -136,6 +136,13 @@ func (c *CA) Bundle() []byte {
 	return pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: c.caCertBytes})
 }
 
+// Pool returns the current CA signing bundle as a *x509.CertPool.
+func (c *CA) Pool() *x509.CertPool {
+	pool := x509.NewCertPool()
+	pool.AppendCertsFromPEM(c.Bundle())
+	return pool
+}
+
 // Issue a new server certificate for the given identity and duration.
 func (c *CA) Issue(subject pkix.Name, dnsNames []string, ips []net.IP, ttl time.Duration) (*tls.Certificate, error) {
 	// Choose a random 128 bit serial number.
diff --git a/internal/certauthority/certauthority_test.go b/internal/certauthority/certauthority_test.go
index 10e74743c..4c1fdf8ed 100644
--- a/internal/certauthority/certauthority_test.go
+++ b/internal/certauthority/certauthority_test.go
@@ -182,6 +182,16 @@ func TestBundle(t *testing.T) {
 	})
 }
 
+func TestPool(t *testing.T) {
+	t.Run("success", func(t *testing.T) {
+		ca, err := New(pkix.Name{CommonName: "test"}, 1*time.Hour)
+		require.NoError(t, err)
+
+		got := ca.Pool()
+		require.Len(t, got.Subjects(), 1)
+	})
+}
+
 type errSigner struct {
 	pubkey crypto.PublicKey
 	err    error