diff --git a/libmproxy/onboarding/app.py b/libmproxy/onboarding/app.py
index f0aecc157..1df12c7c8 100644
--- a/libmproxy/onboarding/app.py
+++ b/libmproxy/onboarding/app.py
@@ -38,27 +38,31 @@ class Index(tornado.web.RequestHandler):
 
 
 class PEM(tornado.web.RequestHandler):
+    @property
+    def filename(self):
+        return config.CONF_BASENAME + "-ca-cert.pem"
+
     def get(self):
-        p = os.path.join(
-            self.request.master.server.config.cadir,
-            config.CONF_BASENAME + "-ca-cert.pem"
-        )
-        self.set_header(
-            "Content-Type", "application/x-x509-ca-cert"
-        )
-        self.write(open(p, "rb").read())
+        p = os.path.join(self.request.master.server.config.cadir, self.filename)
+        self.set_header("Content-Type", "application/x-x509-ca-cert")
+        self.set_header("Content-Disposition", "attachment; filename={}".format(self.filename))
+
+        with open(p, "rb") as f:
+            self.write(f.read())
 
 
 class P12(tornado.web.RequestHandler):
+    @property
+    def filename(self):
+        return config.CONF_BASENAME + "-ca-cert.p12"
+
     def get(self):
-        p = os.path.join(
-            self.request.master.server.config.cadir,
-            config.CONF_BASENAME + "-ca-cert.p12"
-        )
-        self.set_header(
-            "Content-Type", "application/x-pkcs12"
-        )
-        self.write(open(p, "rb").read())
+        p = os.path.join(self.request.master.server.config.cadir, self.filename)
+        self.set_header("Content-Type", "application/x-pkcs12")
+        self.set_header("Content-Disposition", "attachment; filename={}".format(self.filename))
+
+        with open(p, "rb") as f:
+            self.write(f.read())
 
 
 application = tornado.web.Application(