2 files changed, 15 insertions, 0 deletions
diff --git a/lib/chef/resource/chef_client_trusted_certificate.rb b/lib/chef/resource/chef_client_trusted_certificate.rb
index b5272fbe01..356490d350 100644
--- a/lib/chef/resource/chef_client_trusted_certificate.rb
+++ b/lib/chef/resource/chef_client_trusted_certificate.rb
@@ -75,6 +75,7 @@ class Chef
         file cert_path do
           content new_resource.certificate
           mode "0640"
+          sensitive new_resource.sensitive
         end
       end
 
diff --git a/spec/unit/resource/chef_client_trusted_certificate_spec.rb b/spec/unit/resource/chef_client_trusted_certificate_spec.rb
index 558e737555..66f8ebe682 100644
--- a/spec/unit/resource/chef_client_trusted_certificate_spec.rb
+++ b/spec/unit/resource/chef_client_trusted_certificate_spec.rb
@@ -51,4 +51,18 @@ describe Chef::Resource::ChefClientTrustedCertificate do
       expect(provider.cert_path).to match(%r{trusted_certs/something.pem$})
     end
   end
+
+  describe "sensitive attribute" do
+    context "should be insensitive by default" do
+      it { expect(resource.sensitive).to(be_falsey) }
+    end
+
+    context "when set" do
+      before { resource.sensitive(true) }
+
+      it "should be set on the resource" do
+        expect(resource.sensitive).to(be_truthy)
+      end
+    end
+  end
 end