diff --git a/usermin/edit_ipkey.cgi b/usermin/edit_ipkey.cgi
index a57ce4a58..ce5b53ed2 100755
--- a/usermin/edit_ipkey.cgi
+++ b/usermin/edit_ipkey.cgi
@@ -31,6 +31,19 @@ print &ui_table_row($text{'ssl_cert'},
 				$text{'ssl_cert_def'})."\n".
 		    &file_chooser_button("cert"));
 
+$mode = $ipkey->{'extracas'} eq "none" ? 2 :
+	$ipkey->{'extracas'} ? 1 : 0;
+print &ui_table_row($text{'ssl_extracas'},
+	&ui_radio("extracas_mode", $mode,
+		  [ [ 0, $text{'ssl_extracasdef'} ],
+		    [ 2, $text{'ssl_extracasnone'} ],
+		    [ 1, $text{'ssl_extracasbelow'} ] ])."<br>\n".
+	&ui_textarea("extracas",
+		     $mode == 1 ? join("\n",split(/\s+/, $ipkey->{'extracas'}))
+				: "",
+		     3, 60)." ".
+	&file_chooser_button("extracas", 0, undef, undef, 1));
+
 print &ui_table_end();
 if ($in{'new'}) {
 	print &ui_form_end([ [ "create", $text{'create'} ] ]);
diff --git a/usermin/save_ipkey.cgi b/usermin/save_ipkey.cgi
index 6b11648fe..9336124dd 100755
--- a/usermin/save_ipkey.cgi
+++ b/usermin/save_ipkey.cgi
@@ -29,6 +29,20 @@ else {
 	&webmin::validate_key_cert($in{'key'}, $in{'cert_def'} ? undef : $in{'cert'});
 	$ipkey->{'key'} = $in{'key'};
 	$ipkey->{'cert'} = $in{'cert_def'} ? undef : $in{'cert'};
+	if ($in{'extracas_mode'} == 0) {
+		delete($ipkey->{'extracas'});
+		}
+	elsif ($in{'extracas_mode'} == 2) {
+		$ipkey->{'extracas'} = 'none';
+		}
+	else {
+		@files = split(/\s+/, $in{'extracas'});
+		@files || &error($text{'ipkey_eextracas'});
+		foreach $f (@files) {
+			-r $f || &error(&text('ipkey_eextraca', $f));
+			}
+		$ipkey->{'extracas'} = join(' ', @files);
+		}
 
 	# Save or add
 	if ($in{'new'}) {