diff --git a/provisioner/chef-client/provisioner.go b/provisioner/chef-client/provisioner.go
index ea41e954c..b28c9e83a 100644
--- a/provisioner/chef-client/provisioner.go
+++ b/provisioner/chef-client/provisioner.go
@@ -37,6 +37,7 @@ type Config struct {
 	SkipCleanNode        bool     `mapstructure:"skip_clean_node"`
 	SkipInstall          bool     `mapstructure:"skip_install"`
 	StagingDir           string   `mapstructure:"staging_directory"`
+	ClientKey            string   `mapstructure:"client_key"`
 	ValidationKeyPath    string   `mapstructure:"validation_key_path"`
 	ValidationClientName string   `mapstructure:"validation_client_name"`
 
@@ -50,6 +51,7 @@ type Provisioner struct {
 type ConfigTemplate struct {
 	NodeName             string
 	ServerUrl            string
+	ClientKey            string
 	ValidationKeyPath    string
 	ValidationClientName string
 	ChefEnvironment      string
@@ -162,6 +164,10 @@ func (p *Provisioner) Provision(ui packer.Ui, comm packer.Communicator) error {
 		return fmt.Errorf("Error creating staging directory: %s", err)
 	}
 
+	if p.config.ClientKey == "" {
+		p.config.ClientKey = fmt.Sprintf("%s/client.pem", p.config.StagingDir)
+	}
+
 	if p.config.ValidationKeyPath != "" {
 		remoteValidationKeyPath = fmt.Sprintf("%s/validation.pem", p.config.StagingDir)
 		if err := p.copyValidationKey(ui, comm, remoteValidationKeyPath); err != nil {
@@ -170,7 +176,7 @@ func (p *Provisioner) Provision(ui packer.Ui, comm packer.Communicator) error {
 	}
 
 	configPath, err := p.createConfig(
-		ui, comm, nodeName, serverUrl, remoteValidationKeyPath, p.config.ValidationClientName, p.config.ChefEnvironment, p.config.SslVerifyMode)
+		ui, comm, nodeName, serverUrl, p.config.ClientKey, remoteValidationKeyPath, p.config.ValidationClientName, p.config.ChefEnvironment, p.config.SslVerifyMode)
 	if err != nil {
 		return fmt.Errorf("Error creating Chef config file: %s", err)
 	}
@@ -224,7 +230,7 @@ func (p *Provisioner) uploadDirectory(ui packer.Ui, comm packer.Communicator, ds
 	return comm.UploadDir(dst, src, nil)
 }
 
-func (p *Provisioner) createConfig(ui packer.Ui, comm packer.Communicator, nodeName string, serverUrl string, remoteKeyPath string, validationClientName string, chefEnvironment string, sslVerifyMode string) (string, error) {
+func (p *Provisioner) createConfig(ui packer.Ui, comm packer.Communicator, nodeName string, serverUrl string, clientKey string, remoteKeyPath string, validationClientName string, chefEnvironment string, sslVerifyMode string) (string, error) {
 	ui.Message("Creating configuration file 'client.rb'")
 
 	// Read the template
@@ -248,6 +254,7 @@ func (p *Provisioner) createConfig(ui packer.Ui, comm packer.Communicator, nodeN
 	ctx.Data = &ConfigTemplate{
 		NodeName:             nodeName,
 		ServerUrl:            serverUrl,
+		ClientKey:            clientKey,
 		ValidationKeyPath:    remoteKeyPath,
 		ValidationClientName: validationClientName,
 		ChefEnvironment:      chefEnvironment,
@@ -524,6 +531,7 @@ var DefaultConfigTemplate = `
 log_level        :info
 log_location     STDOUT
 chef_server_url  "{{.ServerUrl}}"
+client_key       "{{.ClientKey}}"
 {{if ne .ValidationClientName ""}}
 validation_client_name "{{.ValidationClientName}}"
 {{else}}
diff --git a/website/source/docs/provisioners/chef-client.html.markdown b/website/source/docs/provisioners/chef-client.html.markdown
index a2e2f6f5a..eaeadbf45 100644
--- a/website/source/docs/provisioners/chef-client.html.markdown
+++ b/website/source/docs/provisioners/chef-client.html.markdown
@@ -88,6 +88,9 @@ configuration is actually required.
   this folder. If the permissions are not correct, use a shell provisioner
   prior to this to configure it properly.
 
+* `client_key` (string) - Path to client key. If not set, this defaults to a file
+  named client.pem in `staging_directory`.
+
 * `validation_client_name` (string) - Name of the validation client. If
   not set, this won't be set in the configuration and the default that Chef
   uses will be used.