diff --git a/src/php/ext/grpc/channel_credentials.c b/src/php/ext/grpc/channel_credentials.c
index add896ac517..4fa99b1012d 100644
--- a/src/php/ext/grpc/channel_credentials.c
+++ b/src/php/ext/grpc/channel_credentials.c
@@ -111,6 +111,16 @@ PHP_METHOD(ChannelCredentials, isDefaultRootsPemSet) {
   RETURN_FALSE;
 }
 
+/**
+ * free default roots pem, if it is set
+ */
+PHP_METHOD(ChannelCredentials, invalidateDefaultRootsPem) {
+  if (default_pem_root_certs) {
+    gpr_free(default_pem_root_certs);
+    default_pem_root_certs = NULL;
+  }
+}
+
 /**
  * Create a default channel credentials object.
  * @return ChannelCredentials The new default channel credentials object
@@ -228,6 +238,9 @@ ZEND_END_ARG_INFO()
 ZEND_BEGIN_ARG_INFO_EX(arginfo_isDefaultRootsPemSet, 0, 0, 0)
 ZEND_END_ARG_INFO()
 
+ZEND_BEGIN_ARG_INFO_EX(arginfo_invalidateDefaultRootsPem, 0, 0, 0)
+ZEND_END_ARG_INFO()
+
 ZEND_BEGIN_ARG_INFO_EX(arginfo_createDefault, 0, 0, 0)
 ZEND_END_ARG_INFO()
 
@@ -250,6 +263,8 @@ static zend_function_entry channel_credentials_methods[] = {
          ZEND_ACC_PUBLIC | ZEND_ACC_STATIC)
   PHP_ME(ChannelCredentials, isDefaultRootsPemSet, arginfo_isDefaultRootsPemSet,
          ZEND_ACC_PUBLIC | ZEND_ACC_STATIC)
+  PHP_ME(ChannelCredentials, invalidateDefaultRootsPem, arginfo_invalidateDefaultRootsPem,
+         ZEND_ACC_PUBLIC | ZEND_ACC_STATIC)
   PHP_ME(ChannelCredentials, createDefault, arginfo_createDefault,
          ZEND_ACC_PUBLIC | ZEND_ACC_STATIC)
   PHP_ME(ChannelCredentials, createSsl, arginfo_createSsl,
diff --git a/src/php/lib/Grpc/BaseStub.php b/src/php/lib/Grpc/BaseStub.php
index e92990f1a8b..92d5695f8db 100644
--- a/src/php/lib/Grpc/BaseStub.php
+++ b/src/php/lib/Grpc/BaseStub.php
@@ -33,6 +33,13 @@ class BaseStub
     // a callback function
     private $update_metadata;
 
+    /**
+     * invalidate default roots.pem, before set a different default cert after the first time
+     */
+    public function invalidateDefaultRootsPem()
+    {
+        ChannelCredentials::invalidateDefaultRootsPem();
+    }
     /**
      * @param string  $hostname
      * @param array   $opts