diff --git a/aws/data_source_aws_db_instance.go b/aws/data_source_aws_db_instance.go
index 357a8cd1791..506fa005b5c 100644
--- a/aws/data_source_aws_db_instance.go
+++ b/aws/data_source_aws_db_instance.go
@@ -193,6 +193,11 @@ func dataSourceAwsDbInstance() *schema.Resource {
 				Type:     schema.TypeString,
 				Computed: true,
 			},
+
+			"ca_cert_identifier": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
 		},
 	}
 }
@@ -277,6 +282,7 @@ func dataSourceAwsDbInstanceRead(d *schema.ResourceData, meta interface{}) error
 	d.Set("storage_type", dbInstance.StorageType)
 	d.Set("timezone", dbInstance.Timezone)
 	d.Set("replicate_source_db", dbInstance.ReadReplicaSourceDBInstanceIdentifier)
+	d.Set("ca_cert_identifier", dbInstance.CACertificateIdentifier)
 
 	var vpcSecurityGroups []string
 	for _, v := range dbInstance.VpcSecurityGroups {
diff --git a/aws/resource_aws_db_instance.go b/aws/resource_aws_db_instance.go
index 903287a25a7..3009d32e083 100644
--- a/aws/resource_aws_db_instance.go
+++ b/aws/resource_aws_db_instance.go
@@ -345,6 +345,11 @@ func resourceAwsDbInstance() *schema.Resource {
 				Computed: true,
 			},
 
+			"ca_cert_identifier": {
+				Type:     schema.TypeString,
+				Computed: true,
+			},
+
 			"tags": tagsSchema(),
 		},
 	}
@@ -815,7 +820,6 @@ func resourceAwsDbInstanceRead(d *schema.ResourceData, meta interface{}) error {
 		sgn.Add(*v.DBSecurityGroupName)
 	}
 	d.Set("security_group_names", sgn)
-
 	// replica things
 
 	var replicas []string
@@ -828,6 +832,8 @@ func resourceAwsDbInstanceRead(d *schema.ResourceData, meta interface{}) error {
 
 	d.Set("replicate_source_db", v.ReadReplicaSourceDBInstanceIdentifier)
 
+	d.Set("ca_cert_identifier", v.CACertificateIdentifier)
+
 	return nil
 }
 
diff --git a/aws/resource_aws_db_instance_test.go b/aws/resource_aws_db_instance_test.go
index 53449400ee4..2eab50ef37f 100644
--- a/aws/resource_aws_db_instance_test.go
+++ b/aws/resource_aws_db_instance_test.go
@@ -47,6 +47,7 @@ func TestAccAWSDBInstance_basic(t *testing.T) {
 					resource.TestCheckResourceAttr(
 						"aws_db_instance.bar", "parameter_group_name", "default.mysql5.6"),
 					resource.TestCheckResourceAttrSet("aws_db_instance.bar", "hosted_zone_id"),
+					resource.TestCheckResourceAttrSet("aws_db_instance.bar", "ca_cert_identifier"),
 					resource.TestCheckResourceAttrSet(
 						"aws_db_instance.bar", "resource_id"),
 				),
diff --git a/website/docs/d/db_instance.html.markdown b/website/docs/d/db_instance.html.markdown
index a7d3c0788ff..58d3f6de6a8 100644
--- a/website/docs/d/db_instance.html.markdown
+++ b/website/docs/d/db_instance.html.markdown
@@ -62,3 +62,4 @@ The following attributes are exported:
 * `timezone` - The time zone of the DB instance.
 * `vpc_security_groups` - Provides a list of VPC security group elements that the DB instance belongs to.
 * `replicate_source_db` - The identifier of the source DB that this is a replica of.
+* `ca_cert_identifier` - Specifies the identifier of the CA certificate for the DB instance.
diff --git a/website/docs/r/db_instance.html.markdown b/website/docs/r/db_instance.html.markdown
index 65a598ac5d3..630239aeeaa 100644
--- a/website/docs/r/db_instance.html.markdown
+++ b/website/docs/r/db_instance.html.markdown
@@ -145,6 +145,7 @@ The following attributes are exported:
 * `username` - The master username for the database
 * `storage_encrypted` - Specifies whether the DB instance is encrypted
 * `hosted_zone_id` - The canonical hosted zone ID of the DB instance (to be used in a Route 53 Alias record)
+* `ca_cert_identifier` - Specifies the identifier of the CA certificate for the DB instance.
 
 On Oracle instances the following is exported additionally: