diff --git a/plugins/inputs/x509_cert/README.md b/plugins/inputs/x509_cert/README.md
index 7dd6cde21..8f2be7dc2 100644
--- a/plugins/inputs/x509_cert/README.md
+++ b/plugins/inputs/x509_cert/README.md
@@ -36,6 +36,9 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.
   ##   example: server_name = "myhost.example.org"
   # server_name = "myhost.example.org"
 
+  ## Only output the leaf certificates and omit the root ones.
+  # exclude_root_certs = false
+
   ## Optional TLS Config
   # tls_ca = "/etc/telegraf/ca.pem"
   # tls_cert = "/etc/telegraf/cert.pem"
diff --git a/plugins/inputs/x509_cert/sample.conf b/plugins/inputs/x509_cert/sample.conf
index de7c75bee..d1b94e41a 100644
--- a/plugins/inputs/x509_cert/sample.conf
+++ b/plugins/inputs/x509_cert/sample.conf
@@ -16,6 +16,9 @@
   ##   example: server_name = "myhost.example.org"
   # server_name = "myhost.example.org"
 
+  ## Only output the leaf certificates and omit the root ones.
+  # exclude_root_certs = false
+
   ## Optional TLS Config
   # tls_ca = "/etc/telegraf/ca.pem"
   # tls_cert = "/etc/telegraf/cert.pem"