diff --git a/docs/resources/upstream.md b/docs/resources/upstream.md
index 0077422..344e3d7 100644
--- a/docs/resources/upstream.md
+++ b/docs/resources/upstream.md
@@ -3,6 +3,20 @@
 ## Example Usage
 
 ```hcl
+resource "kong_certificate" "certificate" {
+  certificate  = <<EOF
+    -----BEGIN CERTIFICATE-----
+    ......
+    -----END CERTIFICATE-----
+EOF
+  private_key =  <<EOF
+    -----BEGIN PRIVATE KEY-----
+    .....
+    -----END PRIVATE KEY-----
+EOF
+  snis			= ["foo.com"]
+}
+
 resource "kong_upstream" "upstream" {
     name                 = "sample_upstream"
     slots                = 10
@@ -12,6 +26,10 @@ resource "kong_upstream" "upstream" {
     hash_fallback_header = "FallbackHeaderName"
     hash_on_cookie       = "CookieName"
     hash_on_cookie_path  = "/path"
+    host_header          = "x-host"
+    tags                 = ["a", "b"]
+    client_certificate_id = kong_certificate.certificate.id
+  
     healthchecks {
         active {
             type                     = "https"
diff --git a/kong/resource_kong_upstream.go b/kong/resource_kong_upstream.go
index 2ff6d88..87fcf24 100644
--- a/kong/resource_kong_upstream.go
+++ b/kong/resource_kong_upstream.go
@@ -49,6 +49,22 @@ func resourceKongUpstream() *schema.Resource {
 				ForceNew: false,
 				Default:  nil,
 			},
+			"host_header": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
+			"tags": {
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: false,
+				Elem:     &schema.Schema{Type: schema.TypeString},
+			},
+			"client_certificate_id": {
+				Type:     schema.TypeString,
+				Optional: true,
+				ForceNew: false,
+			},
 			"hash_fallback_header": {
 				Type:     schema.TypeString,
 				Optional: true,
@@ -331,6 +347,22 @@ func resourceKongUpstreamRead(ctx context.Context, d *schema.ResourceData, meta
 		if err := d.Set("healthchecks", flattenHealthCheck(upstream.Healthchecks)); err != nil {
 			return diag.FromErr(err)
 		}
+		err = d.Set("tags", upstream.Tags)
+		if err != nil {
+			return diag.FromErr(err)
+		}
+		if upstream.HostHeader != nil {
+			err = d.Set("host_header", upstream.HostHeader)
+			if err != nil {
+				return diag.FromErr(err)
+			}
+		}
+		if upstream.ClientCertificate != nil {
+			err = d.Set("client_certificate_id", upstream.ClientCertificate.ID)
+			if err != nil {
+				return diag.FromErr(err)
+			}
+		}
 	}
 
 	return diags
@@ -363,6 +395,15 @@ func createKongUpstreamRequestFromResourceData(d *schema.ResourceData) *kong.Ups
 	upstreamRequest.HashFallbackHeader = readStringPtrFromResource(d, "hash_fallback_header")
 	upstreamRequest.HashOnCookie = readStringPtrFromResource(d, "hash_on_cookie")
 	upstreamRequest.HashOnCookiePath = readStringPtrFromResource(d, "hash_on_cookie_path")
+	upstreamRequest.HostHeader = readStringPtrFromResource(d, "host_header")
+	upstreamRequest.Tags = readStringArrayPtrFromResource(d, "tags")
+
+	clientCertificateID := readIdPtrFromResource(d, "client_certificate_id")
+	if clientCertificateID != nil {
+		upstreamRequest.ClientCertificate = &kong.Certificate{
+			ID: clientCertificateID,
+		}
+	}
 
 	if healthChecksArray := readArrayFromResource(d, "healthchecks"); healthChecksArray != nil && len(healthChecksArray) > 0 {
 		healthChecksMap := healthChecksArray[0].(map[string]interface{})
diff --git a/kong/resource_kong_upstream_test.go b/kong/resource_kong_upstream_test.go
index 2416272..d6a0cc0 100644
--- a/kong/resource_kong_upstream_test.go
+++ b/kong/resource_kong_upstream_test.go
@@ -82,7 +82,7 @@ func TestAccKongUpstream(t *testing.T) {
 				),
 			},
 			{
-				Config: testUpdateUpstreamConfig,
+				Config: fmt.Sprintf(testUpdateUpstreamConfig, testCert1, testKey1),
 				Check: resource.ComposeTestCheckFunc(
 					testAccCheckKongUpstreamExists("kong_upstream.upstream"),
 					resource.TestCheckResourceAttr("kong_upstream.upstream", "name", "MyUpstream"),
@@ -94,6 +94,33 @@ func TestAccKongUpstream(t *testing.T) {
 					resource.TestCheckResourceAttr("kong_upstream.upstream", "hash_on_cookie", "CookieName"),
 					resource.TestCheckResourceAttr("kong_upstream.upstream", "hash_on_cookie_path", "/path"),
 
+					resource.TestCheckResourceAttr("kong_upstream.upstream", "host_header", "x-host"),
+					resource.TestCheckResourceAttr("kong_upstream.upstream", "tags.#", "2"),
+					resource.TestCheckResourceAttr("kong_upstream.upstream", "tags.0", "a"),
+					resource.TestCheckResourceAttr("kong_upstream.upstream", "tags.1", "b"),
+					func(s *terraform.State) error {
+						module := s.RootModule()
+						cert, ok := module.Resources["kong_certificate.certificate"]
+						if !ok {
+							return fmt.Errorf("could not find certificate resource")
+						}
+
+						service, ok := module.Resources["kong_upstream.upstream"]
+						if !ok {
+							return fmt.Errorf("could not find upstream resource")
+						}
+
+						v, ok := service.Primary.Attributes["client_certificate_id"]
+						if !ok {
+							return fmt.Errorf("could not find client_certificate_id property")
+						}
+
+						if v != cert.Primary.ID {
+							return fmt.Errorf("client_certificate_id does not match certificate id")
+						}
+						return nil
+					},
+
 					resource.TestCheckResourceAttr("kong_upstream.upstream", "healthchecks.0.active.0.type", "https"),
 					resource.TestCheckResourceAttr("kong_upstream.upstream", "healthchecks.0.active.0.timeout", "10"),
 					resource.TestCheckResourceAttr("kong_upstream.upstream", "healthchecks.0.active.0.concurrency", "20"),
@@ -1048,6 +1075,16 @@ resource "kong_upstream" "upstream" {
 }
 `
 const testUpdateUpstreamConfig = `
+resource "kong_certificate" "certificate" {
+	certificate  = <<EOF
+%s
+EOF
+	private_key =  <<EOF
+%s
+EOF
+   snis			= ["foo.com"]
+}
+
 resource "kong_upstream" "upstream" {
 	name  		         = "MyUpstream"
 	slots 		         = 20
@@ -1057,6 +1094,10 @@ resource "kong_upstream" "upstream" {
 	hash_fallback_header = "FallbackHeaderName"
 	hash_on_cookie       = "CookieName"
 	hash_on_cookie_path  = "/path"
+	host_header          = "x-host"
+    tags                 = ["a", "b"]
+    client_certificate_id = kong_certificate.certificate.id
+
 	healthchecks {
 		active {
 			type                     = "https"