diff --git a/confidant/settings.py b/confidant/settings.py
index facb8b9d..15785f55 100644
--- a/confidant/settings.py
+++ b/confidant/settings.py
@@ -693,6 +693,10 @@ def str_env(var_name, default=''):
 
 CUSTOM_CERTIFICATE_AUTHORITIES = json.loads(b64decode(decrypted_custom_cas)) \
     if decrypted_custom_cas else {}
+    
+# provide a JSON with the following format:
+# {"staging": "some_kid", "production": "some_kid"}
+CUSTOM_CA_ACTIVE_KEYS = json.loads(str_env('CUSTOM_CA_ACTIVE_KEYS', '{}'))
 
 # Configuration validation
 _settings_failures = False