diff --git a/directives.go b/directives.go
index 5ffd625..74e326d 100644
--- a/directives.go
+++ b/directives.go
@@ -8,6 +8,7 @@ import (
 	"strings"
 
 	"git.sr.ht/~emersion/go-scfg"
+	"github.com/caddyserver/certmagic"
 )
 
 func parseConfig(srv *Server, cfg scfg.Block) error {
@@ -159,6 +160,8 @@ func parseTLS(srv *Server, d *scfg.Directive) error {
 				return err
 			}
 			srv.ACMEManager.Email = email
+		case "on_demand":
+			srv.ACMEConfig.OnDemand = &certmagic.OnDemandConfig{}
 		default:
 			return fmt.Errorf("unknown %q directive", child.Name)
 		}
diff --git a/tlstunnel.1.scd b/tlstunnel.1.scd
index b4c409a..5910e4a 100644
--- a/tlstunnel.1.scd
+++ b/tlstunnel.1.scd
@@ -95,6 +95,9 @@ The following directives are supported:
 		The email address to use when creating or selecting an existing ACME
 		server account
 
+	*on_demand*
+		Enable on-demand TLS.
+
 # FILES
 
 _/etc/tlstunnel/config_