diff --git a/docs/tls-spdy-support.md b/docs/tls-spdy-support.md
index 80f472421..430af9ce0 100644
--- a/docs/tls-spdy-support.md
+++ b/docs/tls-spdy-support.md
@@ -28,3 +28,13 @@ The nginx configuration will need to be reloaded in order for the updated TLS co
 The [HSTS header](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) is an HTTP header that can inform browsers that all requests to a given site should be made via HTTPS. dokku does not, by default, enable this header. It is thus left up to you, the user, to enable it for your site.
 
 Beware that if you enable the header and a subsequent deploy of your application results in an HTTP deploy (for whatever reason), the way the header works means that a browser will not attempt to request the HTTP version of your site if the HTTPS version fails.
+
+## Importing ssl certificates
+
+You can import ssl certificates via tarball using the following command:
+
+``` bash
+dokku nginx:import-ssl myapp < archive-of-certs.tar
+```
+
+This archive should is expanded via `tar xvf`. It should contain `server.crt` and `server.key`.
diff --git a/plugins/nginx-vhosts/commands b/plugins/nginx-vhosts/commands
new file mode 100755
index 000000000..59943655c
--- /dev/null
+++ b/plugins/nginx-vhosts/commands
@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -eo pipefail; [[ $DOKKU_TRACE ]] && set -x
+
+case "$1" in
+  nginx:import-ssl)
+    if [[ -z $2 ]]; then
+      echo "Please specify an app to create"
+      exit 1
+    fi
+    APP="$2"
+    if [[ ! -d "$DOKKU_ROOT/$APP" ]]; then
+      echo "App $APP does not exist"
+      exit 1
+    fi
+    if [[ -t 0 ]]; then
+      echo "Tar archive containing server.crt and server.key expected on stdin"
+      exit 1
+    fi
+
+    TEMP_DIR=`mktemp -d`
+    cd $TEMP_DIR
+    tar xvf - <&0
+    if [[ -f "$TEMP_DIR/server.crt" ]]; then
+      echo "Tar archive missing server.crt"
+      exit 1
+    fi
+    if [[ -f "$TEMP_DIR/server.key" ]]; then
+      echo "Tar archive missing server.key"
+      exit 1
+    fi
+
+    mkdir -p "$DOKKU_ROOT/$APP/tls"
+    mv "$TEMP_DIR/server.crt" "$DOKKU_ROOT/$APP/tls/server.crt"
+    mv "$TEMP_DIR/server.key" "$DOKKU_ROOT/$APP/tls/server.key"
+    rm -rf $TEMP_DIR
+    ;;
+  help)
+    cat  && cat<<EOF
+    nginx:import-ssl <app>                          Imports a tarball from stdin; should contain server.crt and server.key
+EOF
+    ;;
+
+esac