diff --git a/src/client/options/mod.rs b/src/client/options/mod.rs
index 3996bb3de..82a509ad8 100644
--- a/src/client/options/mod.rs
+++ b/src/client/options/mod.rs
@@ -10,6 +10,7 @@ use std::{
     fs::File,
     hash::{Hash, Hasher},
     io::{BufReader, Seek, SeekFrom},
+    path::PathBuf,
     str::FromStr,
     sync::Arc,
     time::Duration,
@@ -564,13 +565,13 @@ pub struct TlsOptions {
     /// The path to the CA file that the [`Client`](../struct.Client.html) should use for TLS. If
     /// none is specified, then the driver will use the Mozilla root certificates from the
     /// `webpki-roots` crate.
-    pub ca_file_path: Option<String>,
+    pub ca_file_path: Option<PathBuf>,
 
     /// The path to the certificate file that the [`Client`](../struct.Client.html) should present
     /// to the server to verify its identify. If none is specified, then the
     /// [`Client`](../struct.Client.html) will not attempt to verify its identity to the
     /// server.
-    pub cert_key_file_path: Option<String>,
+    pub cert_key_file_path: Option<PathBuf>,
 }
 
 struct NoCertVerifier {}
@@ -603,7 +604,10 @@ impl TlsOptions {
             store
                 .add_pem_file(&mut BufReader::new(File::open(&path)?))
                 .map_err(|_| ErrorKind::InvalidTlsConfig {
-                    message: format!("Unable to parse PEM-encoded root certificate from {}", path),
+                    message: format!(
+                        "Unable to parse PEM-encoded root certificate from {}",
+                        path.display()
+                    ),
                 })?;
         } else {
             store.add_server_trust_anchors(&TLS_SERVER_ROOTS);
@@ -619,7 +623,7 @@ impl TlsOptions {
                     return Err(ErrorKind::InvalidTlsConfig {
                         message: format!(
                             "Unable to parse PEM-encoded client certificate from {}",
-                            path
+                            path.display()
                         ),
                     }
                     .into())
@@ -631,7 +635,10 @@ impl TlsOptions {
                 Ok(key) => key,
                 Err(()) => {
                     return Err(ErrorKind::InvalidTlsConfig {
-                        message: format!("Unable to parse PEM-encoded RSA key from {}", path),
+                        message: format!(
+                            "Unable to parse PEM-encoded RSA key from {}",
+                            path.display()
+                        ),
                     }
                     .into())
                 }
@@ -1623,13 +1630,11 @@ impl ClientOptionsParser {
                     .into());
                 }
                 Some(Tls::Enabled(ref mut options)) => {
-                    options.ca_file_path = Some(value.to_string());
+                    options.ca_file_path = Some(value.into());
                 }
                 None => {
                     self.tls = Some(Tls::Enabled(
-                        TlsOptions::builder()
-                            .ca_file_path(value.to_string())
-                            .build(),
+                        TlsOptions::builder().ca_file_path(value.into()).build(),
                     ))
                 }
             },
@@ -1641,12 +1646,12 @@ impl ClientOptionsParser {
                     .into());
                 }
                 Some(Tls::Enabled(ref mut options)) => {
-                    options.cert_key_file_path = Some(value.to_string());
+                    options.cert_key_file_path = Some(value.into());
                 }
                 None => {
                     self.tls = Some(Tls::Enabled(
                         TlsOptions::builder()
-                            .cert_key_file_path(value.to_string())
+                            .cert_key_file_path(value.into())
                             .build(),
                     ))
                 }
diff --git a/src/client/options/test.rs b/src/client/options/test.rs
index 52211c959..13da357dc 100644
--- a/src/client/options/test.rs
+++ b/src/client/options/test.rs
@@ -153,11 +153,11 @@ fn document_from_client_options(mut options: ClientOptions) -> Document {
 
         if let Some(s) = ca_file_path {
             doc.insert("tls", true);
-            doc.insert("tlscafile", s);
+            doc.insert("tlscafile", s.to_str().unwrap());
         }
 
         if let Some(s) = cert_key_file_path {
-            doc.insert("tlscertificatekeyfile", s);
+            doc.insert("tlscertificatekeyfile", s.to_str().unwrap());
         }
 
         if let Some(b) = allow_invalid_certificates {
diff --git a/src/cmap/test/mod.rs b/src/cmap/test/mod.rs
index 043988780..b5518d728 100644
--- a/src/cmap/test/mod.rs
+++ b/src/cmap/test/mod.rs
@@ -323,10 +323,26 @@ impl Matchable for TlsOptions {
     fn content_matches(&self, expected: &TlsOptions) -> bool {
         self.allow_invalid_certificates
             .matches(&expected.allow_invalid_certificates)
-            && self.ca_file_path.matches(&expected.ca_file_path)
+            && self
+                .ca_file_path
+                .as_ref()
+                .map(|pb| pb.display().to_string())
+                .matches(
+                    &expected
+                        .ca_file_path
+                        .as_ref()
+                        .map(|pb| pb.display().to_string()),
+                )
             && self
                 .cert_key_file_path
-                .matches(&expected.cert_key_file_path)
+                .as_ref()
+                .map(|pb| pb.display().to_string())
+                .matches(
+                    &expected
+                        .cert_key_file_path
+                        .as_ref()
+                        .map(|pb| pb.display().to_string()),
+                )
     }
 }
 
diff --git a/src/test/client.rs b/src/test/client.rs
index a5d2ed8a2..241a9cea3 100644
--- a/src/test/client.rs
+++ b/src/test/client.rs
@@ -360,7 +360,7 @@ async fn auth_test_uri(
             uri.push_str("&tlsCAFile=");
             uri.push_str(
                 &percent_encoding::utf8_percent_encode(
-                    ca_file_path,
+                    ca_file_path.to_str().unwrap(),
                     percent_encoding::NON_ALPHANUMERIC,
                 )
                 .to_string(),
@@ -371,7 +371,7 @@ async fn auth_test_uri(
             uri.push_str("&tlsCertificateKeyFile=");
             uri.push_str(
                 &percent_encoding::utf8_percent_encode(
-                    cert_key_file_path,
+                    cert_key_file_path.to_str().unwrap(),
                     percent_encoding::NON_ALPHANUMERIC,
                 )
                 .to_string(),