diff --git a/tool/tctl/common/resource_command.go b/tool/tctl/common/resource_command.go
index 5ff35aa077746..e4544da6778a7 100644
--- a/tool/tctl/common/resource_command.go
+++ b/tool/tctl/common/resource_command.go
@@ -72,6 +72,7 @@ func (g *ResourceCommand) Initialize(app *kingpin.Application, config *service.C
 		services.KindUser:            g.createUser,
 		services.KindTrustedCluster:  g.createTrustedCluster,
 		services.KindGithubConnector: g.createGithubConnector,
+		services.KindCertAuthority:   g.createCertAuthority,
 	}
 	g.config = config
 
@@ -213,6 +214,19 @@ func (u *ResourceCommand) createTrustedCluster(client auth.ClientI, raw services
 	return nil
 }
 
+// createCertAuthority creates certificate authority
+func (u *ResourceCommand) createCertAuthority(client auth.ClientI, raw services.UnknownResource) error {
+	certAuthority, err := services.GetCertAuthorityMarshaler().UnmarshalCertAuthority(raw.Raw)
+	if err != nil {
+		return trace.Wrap(err)
+	}
+	if err := client.UpsertCertAuthority(certAuthority); err != nil {
+		return trace.Wrap(err)
+	}
+	fmt.Printf("certificate authority '%s' has been updated\n", certAuthority.GetName())
+	return nil
+}
+
 func (u *ResourceCommand) createGithubConnector(client auth.ClientI, raw services.UnknownResource) error {
 	connector, err := services.GetGithubConnectorMarshaler().Unmarshal(raw.Raw)
 	if err != nil {