diff --git a/doc/10-icinga-template-library.md b/doc/10-icinga-template-library.md
index 6b816cf08..b5b5e7a86 100644
--- a/doc/10-icinga-template-library.md
+++ b/doc/10-icinga-template-library.md
@@ -2783,6 +2783,21 @@ icingacli_elasticsearch_warning           | **Required.** Warning threshold
 icingacli_elasticsearch_filter            | **Required.** Filter for events
 icingacli_elasticsearch_from              | **Optional.** Negative value of time to search from now (Default: -5m)
 
+#### x509 <a id="plugin-contrib-icingacli-x509"></a>
+
+This subcommand is provided by the [x509 module](https://github.com/Icinga/icingaweb2-module-x509) and executed as `icingacli x509 check host`. Please refer to the [documentation](https://github.com/Icinga/icingaweb2-module-x509/blob/master/doc/10-Monitoring.md#host-check-command) for more information.
+
+Custom attributes passed as [command parameters](03-monitoring-basics.md#command-passing-parameters):
+
+Name                                      | Description
+------------------------------------------|-----------------------------------------------------------------------------------------
+icingacli_x509_ip                         | **Required.** A hosts IP address [or]
+icingacli_x509_host                       | **Required.** A hosts name
+icingacli_x509_port                       | **Optional.** The port to check in particular
+icingacli_x509_warning                    | **Optional.** Less remaining time results in state WARNING (Default: 25%)
+icingacli_x509_critical                   | **Optional.** Less remaining time results in state CRITICAL (Default: 10%)
+icingacli_x509_allow_self_signed          | **Optional.** Ignore if a certificate or its issuer has been self-signed (Default: false)
+
 ### IPMI Devices <a id="plugin-contrib-ipmi"></a>
 
 This category includes all plugins for IPMI devices.
diff --git a/itl/plugins-contrib.d/icingacli.conf b/itl/plugins-contrib.d/icingacli.conf
index cc7401845..3086aabec 100644
--- a/itl/plugins-contrib.d/icingacli.conf
+++ b/itl/plugins-contrib.d/icingacli.conf
@@ -85,3 +85,36 @@ object CheckCommand "icingacli-elasticsearch" {
 
 }
 
+object CheckCommand "icingacli-x509" {
+        import "icingacli"
+
+        command += [ "x509", "check", "host" ]
+
+        arguments = {
+                "--ip" = {
+                        value = "$icingacli_x509_ip$"
+                        description = "A hosts IP address"
+                }
+                "--host" = {
+                        value = "$icingacli_x509_host$"
+                        description = "A hosts name"
+                }
+                "--port" = {
+                        value = "$icingacli_x509_port$"
+                        description = "The port to check in particular"
+                }
+                "--warning" = {
+                        value = "$icingacli_x509_warning$"
+                        description = "Less remaining time results in state WARNING"
+                }
+                "--critical" = {
+                        value = "$icingacli_x509_critical$"
+                        description = "Less remaining time results in state CRITICAL"
+                }
+                "--allow-self-signed" = {
+                        set_if = "$icingacli_x509_allow_self_signed$"
+                        description = "Ignore if a certificate or its issuer has been self-signed"
+                }
+        }
+}
+