diff --git a/pkg/tlsclientconfig/loader/load.go b/pkg/tlsclientconfig/loader/load.go
index 64491782..76131282 100644
--- a/pkg/tlsclientconfig/loader/load.go
+++ b/pkg/tlsclientconfig/loader/load.go
@@ -37,6 +37,10 @@ func (l *Loader) Load(config tlsclientconfig.Config) (*tls.Config, error) {
 			return nil, xerrors.Errorf("could not load the certificate: %w", err)
 		}
 	}
+	if len(rootCAs.Subjects()) == 0 {
+		// use the host's root CA set
+		rootCAs = nil
+	}
 	return &tls.Config{
 		RootCAs:            rootCAs,
 		InsecureSkipVerify: config.SkipTLSVerify,
diff --git a/pkg/tlsclientconfig/loader/load_test.go b/pkg/tlsclientconfig/loader/load_test.go
index b6e3fb06..cac77af0 100644
--- a/pkg/tlsclientconfig/loader/load_test.go
+++ b/pkg/tlsclientconfig/loader/load_test.go
@@ -9,6 +9,15 @@ import (
 
 func TestLoader_Load(t *testing.T) {
 	var loader Loader
+	t.Run("Zero", func(t *testing.T) {
+		cfg, err := loader.Load(tlsclientconfig.Config{})
+		if err != nil {
+			t.Errorf("Load error: %s", err)
+		}
+		if cfg.RootCAs != nil {
+			t.Errorf("RootCAs wants nil but was %+v", cfg.RootCAs)
+		}
+	})
 	t.Run("ValidFile", func(t *testing.T) {
 		cfg, err := loader.Load(tlsclientconfig.Config{
 			CACertFilename: []string{"testdata/ca1.crt"},