diff --git a/mercurial/hg.py b/mercurial/hg.py
--- a/mercurial/hg.py
+++ b/mercurial/hg.py
@@ -551,6 +551,6 @@ def remoteui(src, opts):
             dst.setconfig(sect, key, val)
     v = src.config('web', 'cacerts')
     if v:
-        dst.setconfig('web', 'cacerts', v)
+        dst.setconfig('web', 'cacerts', util.expandpath(v))
 
     return dst
diff --git a/mercurial/url.py b/mercurial/url.py
--- a/mercurial/url.py
+++ b/mercurial/url.py
@@ -512,6 +512,8 @@ if has_https:
         def connect(self):
             if hasattr(self, 'ui'):
                 cacerts = self.ui.config('web', 'cacerts')
+                if cacerts:
+                    cacerts = util.expandpath(cacerts)
             else:
                 cacerts = None
 
diff --git a/tests/test-https.t b/tests/test-https.t
--- a/tests/test-https.t
+++ b/tests/test-https.t
@@ -154,11 +154,12 @@ cacert configured in local repo
   no changes found
   $ mv copy-pull/.hg/hgrc.bu copy-pull/.hg/hgrc
 
-cacert configured globally
+cacert configured globally, also testing expansion of environment
+variables in the filename
 
   $ echo "[web]" >> $HGRCPATH
-  $ echo "cacerts=`pwd`/pub.pem" >> $HGRCPATH
-  $ hg -R copy-pull pull
+  $ echo 'cacerts=$P/pub.pem' >> $HGRCPATH
+  $ P=`pwd` hg -R copy-pull pull
   pulling from https://localhost:$HGPORT/
   searching for changes
   no changes found