diff --git a/interop-testing/src/test/java/io/grpc/testing/integration/Http2OkHttpTest.java b/interop-testing/src/test/java/io/grpc/testing/integration/Http2OkHttpTest.java
index 3a59f7d..652d3ca 100644
--- a/interop-testing/src/test/java/io/grpc/testing/integration/Http2OkHttpTest.java
+++ b/interop-testing/src/test/java/io/grpc/testing/integration/Http2OkHttpTest.java
@@ -88,8 +88,7 @@
         .overrideAuthority(GrpcUtil.authorityFromHostAndPort(
             TestUtils.TEST_SERVER_HOST, serverPort));
     try {
-      builder.sslSocketFactory(TestUtils.newSslSocketFactoryForCa(
-          TestUtils.loadCert("ca.pem")));
+      builder.sslSocketFactory(TestUtils.newSslSocketFactoryForCa(TestUtils.loadCert("ca.pem")));
     } catch (Exception e) {
       throw new RuntimeException(e);
     }
diff --git a/testing/src/main/java/io/grpc/testing/TestUtils.java b/testing/src/main/java/io/grpc/testing/TestUtils.java
index 1127cfb..f29baec 100644
--- a/testing/src/main/java/io/grpc/testing/TestUtils.java
+++ b/testing/src/main/java/io/grpc/testing/TestUtils.java
@@ -217,11 +217,23 @@
    * Creates an SSLSocketFactory which contains {@code certChainFile} as its only root certificate.
    */
   public static SSLSocketFactory newSslSocketFactoryForCa(File certChainFile) throws Exception {
+    InputStream is = new FileInputStream(certChainFile);
+    try {
+      return newSslSocketFactoryForCa(is);
+    } finally {
+      is.close();
+    }
+  }
+
+  /**
+   * Creates an SSLSocketFactory which contains {@code certChainFile} as its only root certificate.
+   */
+  public static SSLSocketFactory newSslSocketFactoryForCa(InputStream certChain) throws Exception {
     KeyStore ks = KeyStore.getInstance("JKS");
     ks.load(null, null);
     CertificateFactory cf = CertificateFactory.getInstance("X.509");
     X509Certificate cert = (X509Certificate) cf.generateCertificate(
-        new BufferedInputStream(new FileInputStream(certChainFile)));
+        new BufferedInputStream(certChain));
     X500Principal principal = cert.getSubjectX500Principal();
     ks.setCertificateEntry(principal.getName("RFC2253"), cert);