diff --git a/cli/koji b/cli/koji
index 08bd6d57..2e3d30ee 100755
--- a/cli/koji
+++ b/cli/koji
@@ -121,7 +121,7 @@ def get_options():
     parser.add_option("--principal", help=_("specify a Kerberos principal to use"))
     parser.add_option("--krbservice", help=_("specify the Kerberos service name for the hub"))
     parser.add_option("--cert", help=_("specify a SSL cert to use"), metavar="FILE")
-    parser.add_option("--ca", help=_("specify a SSL CA to use"), metavar="FILE")
+    parser.add_option("--ca", help=SUPPRESS_HELP, metavar="FILE")
     parser.add_option("--runas", help=_("run as the specified user (requires special privileges)"))
     parser.add_option("--user", help=_("specify user"))
     parser.add_option("--password", help=_("specify password"))
diff --git a/koji/__init__.py b/koji/__init__.py
index edc8ac5d..9c3ed942 100644
--- a/koji/__init__.py
+++ b/koji/__init__.py
@@ -1914,6 +1914,9 @@ def read_config(profile_name, user_config=None):
         else:
             result[name] = os.path.expanduser(result[name])
 
+    if result.get('ca'):
+        util.deprecated("--ca option is deprecated and will be removed in 1.24")
+
     return result
 
 
diff --git a/util/koji-gc b/util/koji-gc
index 9b4f2e75..003053c2 100755
--- a/util/koji-gc
+++ b/util/koji-gc
@@ -27,7 +27,7 @@ from six.moves import email_mime_text as MIMEText
 
 import koji
 import koji.policy
-from koji.util import LazyDict, LazyValue, to_list
+from koji.util import LazyDict, LazyValue, to_list, deprecated
 
 
 def _(args):
@@ -54,8 +54,7 @@ def get_options():
     parser.add_option("--network-hack", action="store_true", default=False,
                       help=optparse.SUPPRESS_HELP)  # no longer used
     parser.add_option("--cert", help=_("Client SSL certificate file for authentication"))
-    parser.add_option("--ca", default='',
-                      help=_("ignored"))  # FIXME: remove in next major release
+    parser.add_option("--ca", help=optparse.SUPPRESS_HELP)  # FIXME: remove in next major release
     parser.add_option("--serverca", help=_("CA cert file that issued the hub certificate"))
     parser.add_option("-n", "--test", action="store_true", default=False,
                       help=_("test mode"))
@@ -164,6 +163,9 @@ def get_options():
     (options, args) = parser.parse_args(values=defaults)
     options.config = config
 
+    if options.ca:
+        deprecated("--ca option is deprecated and will be removed in 1.24")
+
     # figure out actions
     actions = ('prune', 'trash', 'delete', 'salvage')
     if options.action: